diff --git a/.htaccess b/.htaccess index 6c370407..c7c01254 100755 --- a/.htaccess +++ b/.htaccess @@ -6,6 +6,13 @@ Order allow,deny + + RewriteEngine On + # Protect hidden directory from vulnerability scanner + RewriteRule (^|/)\.([^/]+)(/|$) - [L,F] + RewriteRule (^|/)([^/]+)~(/|$) - [L,F] + + # Don't show directory listings for URLs which map to a directory. Options -Indexes diff --git a/admin/admin_template/akasia-dz/index_template.inc.php b/admin/admin_template/akasia-dz/index_template.inc.php index 3ee56264..4c2bb8dc 100644 --- a/admin/admin_template/akasia-dz/index_template.inc.php +++ b/admin/admin_template/akasia-dz/index_template.inc.php @@ -86,7 +86,15 @@
- Photo <?php echo $_SESSION['realname']?> + + Photo <?php echo $_SESSION['realname'] ?>

diff --git a/admin/admin_template/akasia/index_template.inc.php b/admin/admin_template/akasia/index_template.inc.php index 8d3b7d77..cda818f6 100755 --- a/admin/admin_template/akasia/index_template.inc.php +++ b/admin/admin_template/akasia/index_template.inc.php @@ -85,7 +85,15 @@

diff --git a/admin/admin_template/default/index_template.inc.php b/admin/admin_template/default/index_template.inc.php index 99691d67..c502c8e4 100755 --- a/admin/admin_template/default/index_template.inc.php +++ b/admin/admin_template/default/index_template.inc.php @@ -34,8 +34,8 @@ - + @@ -64,7 +64,15 @@
@@ -294,4 +294,4 @@ let fileName = $(this).val().replace(/\\/g, '/').replace(/.*\//, ''); $(this).parent('.custom-file').find('.custom-file-label').text(fileName); }); - \ No newline at end of file + diff --git a/admin/modules/bibliography/index.php b/admin/modules/bibliography/index.php index f9f80b8b..a264df64 100755 --- a/admin/modules/bibliography/index.php +++ b/admin/modules/bibliography/index.php @@ -226,8 +226,15 @@ function getimagesizefromstring($string_data) $image_upload->setAllowableFormat($sysconf['allowed_images']); $image_upload->setMaxSize($sysconf['max_image_upload'] * 1024); $image_upload->setUploadDir(IMGBS . 'docs'); + + $img_title = $data['title'].'_'.date("YmdHis"); + if(strlen($data['title']) > 70){ + $img_title = substr($data['title'], 0, 70).'_'.date("YmdHis"); + } + + $new_filename = strtolower('cover_'. preg_replace("/[^a-zA-Z0-9]+/", "-", $img_title)); // upload the file and change all space characters to underscore - $img_upload_status = $image_upload->doUpload('image', preg_replace('@\s+@i', '_', $_FILES['image']['name'])); + $img_upload_status = $image_upload->doUpload('image', $new_filename); if ($img_upload_status == UPLOAD_SUCCESS) { $data['image'] = $dbs->escape_string($image_upload->new_filename); // write log @@ -235,8 +242,9 @@ function getimagesizefromstring($string_data) utility::jsToastr('Bibliography', __('Image Uploaded Successfully'), 'success'); } else { // write log + $data['image'] = NULL; utility::writeLogs($dbs, 'staff', $_SESSION['uid'], 'bibliography', 'ERROR : ' . $_SESSION['realname'] . ' FAILED TO upload image file ' . $image_upload->new_filename . ', with error (' . $image_upload->error . ')'); - utility::jsToastr('Bibliography', __('Image Uploaded Failed'), 'error'); + utility::jsToastr('Bibliography', __('Image Uploaded Failed').'
'.$image_upload->error, 'error'); } } else if (!empty($_POST['base64picstring'])) { list($filedata, $filedom) = explode('#image/type#', $_POST['base64picstring']); diff --git a/admin/modules/bibliography/item_import.php b/admin/modules/bibliography/item_import.php index 42a12552..f0531f3a 100755 --- a/admin/modules/bibliography/item_import.php +++ b/admin/modules/bibliography/item_import.php @@ -133,30 +133,39 @@ $item_status = utility::getID($dbs, 'mst_item_status', 'item_status_id', 'item_status_name', $field[9], $stat_id_cache); $item_status = $item_status?'\''.$item_status.'\'':'NULL'; $site = $field[10]?'\''.$field[10].'\'':'NULL'; - $source = $field[11]?'\''.$field[11].'\'':'NULL'; + $source = $field[11]?'\''.$field[11].'\'':'0'; $invoice = $field[12]?'\''.$field[12].'\'':'NULL'; $price = $field[13]?'\''.$field[13].'\'':'NULL'; $price_currency = $field[14]?'\''.$field[14].'\'':'NULL'; $invoice_date = $field[15]?'\''.$field[15].'\'':'NULL'; - $input_date = '\''.$field[16].'\''; - $last_update = '\''.$field[17].'\''; - - // sql insert string - $sql_str = "INSERT INTO item (item_code, call_number, coll_type_id, - inventory_code, received_date, supplier_id, - order_no, location_id, order_date, item_status_id, site, - source, invoice, price, price_currency, invoice_date, - input_date, last_update) - VALUES ($item_code, $call_number, $coll_type, - $inventory_code, $received_date, $supplier, - $order_no, $location, $order_date, $item_status, $site, - $source, $invoice, $price, $price_currency, $invoice_date, - $input_date, $last_update)"; + $input_date = $field[16]?'\''.$field[16].'\'':'\''.date('Y-m-d H:i:s').'\''; + $last_update = $field[17]?'\''.$field[17].'\'':'\''.date('Y-m-d H:i:s').'\''; + $title = $field[18]; // first field is header if (isset($_POST['header']) && $n < 1) { $n++; + continue; } else { + + // get biblio_id + $b_q = $dbs->query(sprintf("select biblio_id from biblio where title = '%s'", $title)); + if($b_q->num_rows < 1) continue; + $b_d = $b_q->fetch_row(); + $biblio_id = $b_d[0]; + + // sql insert string + $sql_str = "INSERT INTO item (biblio_id, item_code, call_number, coll_type_id, + inventory_code, received_date, supplier_id, + order_no, location_id, order_date, item_status_id, site, + source, invoice, price, price_currency, invoice_date, + input_date, last_update) + VALUES ($biblio_id, $item_code, $call_number, $coll_type, + $inventory_code, $received_date, $supplier, + $order_no, $location, $order_date, $item_status, $site, + $source, $invoice, $price, $price_currency, $invoice_date, + $input_date, $last_update)"; + // send query // die($sql_str); $dbs->query($sql_str); diff --git a/admin/modules/bibliography/marcexport.php b/admin/modules/bibliography/marcexport.php index 8fbf72cb..7729472e 100644 --- a/admin/modules/bibliography/marcexport.php +++ b/admin/modules/bibliography/marcexport.php @@ -216,14 +216,14 @@ require LIB.'biblio_list_index.inc.php'; } // table spec - $table_spec = 'search_biblio'; + $table_spec = 'search_biblio AS `index`'; $datagrid->setSQLColumn('biblio_id', 'title AS \''.__('Title').'\'', 'author AS \''.__('Author').'\''); } else { require LIB.'biblio_list.inc.php'; // table spec - $table_spec = 'search_biblio'; + $table_spec = 'search_biblio AS `index`'; $datagrid->setSQLColumn('biblio_id', 'title AS \''.__('Title').'\'', 'author AS \''.__('Author').'\''); diff --git a/admin/modules/bibliography/pop_attach.php b/admin/modules/bibliography/pop_attach.php index 8cb9a2fb..487b6913 100755 --- a/admin/modules/bibliography/pop_attach.php +++ b/admin/modules/bibliography/pop_attach.php @@ -88,6 +88,8 @@ $fdata['file_url'] = $dbs->escape_string($url); $fdata['file_dir'] = $dbs->escape_string($file_dir); $fdata['file_desc'] = $dbs->escape_string(trim(strip_tags($_POST['fileDesc']))); + if(isset($_POST['fileKey']) && trim($_POST['fileKey']) !== '') + $fdata['file_key'] = $dbs->escape_string(trim(strip_tags($_POST['fileKey']))); $fdata['mime_type'] = $sysconf['mimetype'][$file_ext]; $fdata['input_date'] = date('Y-m-d H:i:s'); $fdata['last_update'] = $fdata['input_date']; @@ -110,6 +112,8 @@ $fdata['file_url'] = $dbs->escape_string($fdata['file_name']); $fdata['file_dir'] = 'literal{NULL}'; $fdata['file_desc'] = $dbs->escape_string(trim(strip_tags($_POST['fileDesc']))); + if(isset($_POST['fileKey']) && trim($_POST['fileKey']) !== '') + $fdata['file_key'] = $dbs->escape_string(trim(strip_tags($_POST['fileKey']))); $fdata['mime_type'] = 'text/uri-list'; $fdata['input_date'] = date('Y-m-d H:i:s'); $fdata['last_update'] = $fdata['input_date']; @@ -144,7 +148,10 @@ // file biblio access update $update1 = $sql_op->update('biblio_attachment', array('access_type' => $data['access_type'], 'access_limit' => $data['access_limit'], 'placement' => $data['placement']), 'biblio_id='.$updateBiblioID.' AND file_id='.$fileID); // file description update - $update2 = $sql_op->update('files', array('file_title' => $title, 'file_url' => $url, 'file_desc' => $dbs->escape_string(trim($_POST['fileDesc']))), 'file_id='.$fileID); + $file_desc_update = array('file_title' => $title, 'file_url' => $url, 'file_desc' => $dbs->escape_string(trim($_POST['fileDesc']))); + if(isset($_POST['fileKey'])) + $file_desc_update['file_key'] = $dbs->escape_string(trim(strip_tags($_POST['fileKey']))); + $update2 = $sql_op->update('files', $file_desc_update, 'file_id='.$fileID); if ($update1) { utility::jsToastr('File Attachment', __('File Attachment data updated!'), 'success'); echo ''; + $xlsquery = "SELECT i.item_code AS '" . __('Item Code') . "', + b.title AS '" . __('Title') . "', + ct.coll_type_name AS '" . __('Collection Type') . "', + i.item_status_id AS '" . __('Item Status') . "', + b.call_number AS '" . __('Call Number') . "' FROM " . + $table_spec . " WHERE " . $criteria; + // echo $xlsquery; + unset($_SESSION['xlsdata']); + $_SESSION['xlsquery'] = $xlsquery; + $_SESSION['tblout'] = "title_list_item"; + $content = ob_get_clean(); // include the page template - require SB.'/admin/'.$sysconf['admin_template']['dir'].'/printed_page_tpl.php'; + require SB . '/admin/' . $sysconf['admin_template']['dir'] . '/printed_page_tpl.php'; } diff --git a/admin/modules/system/app_user.php b/admin/modules/system/app_user.php index 6ff5be94..ab99f29d 100755 --- a/admin/modules/system/app_user.php +++ b/admin/modules/system/app_user.php @@ -74,6 +74,8 @@ function getUserType($obj_db, $array_data, $col) { if ($query_image->num_rows > 0) { $_delete = $dbs->query(sprintf('UPDATE user SET user_image=NULL WHERE user_id=%d', $_POST['uimg'])); if ($_delete) { + // Change upict + $_SESSION['upict'] = 'person.png'; $postImage = stripslashes($_POST['img']); $postImage = str_replace('/', '', $postImage); @unlink(sprintf(IMGBS.'persons/%s', $postImage)); @@ -177,6 +179,8 @@ function getUserType($obj_db, $array_data, $col) { // upload status alert if (isset($upload_status)) { if ($upload_status == UPLOAD_SUCCESS) { + // Change upict + $_SESSION['upict'] = $data['user_image']; // write log utility::writeLogs($dbs, 'staff', $_SESSION['uid'], 'system/user', $_SESSION['realname'].' upload image file '.$upload->new_filename, 'User image', 'Upload'); utility::jsAlert(__('Image Uploaded Successfully')); @@ -200,6 +204,8 @@ function getUserType($obj_db, $array_data, $col) { // upload status alert if (isset($upload_status)) { if ($upload_status == UPLOAD_SUCCESS) { + // Change upict + $_SESSION['upict'] = $data['user_image']; // write log utility::writeLogs($dbs, 'staff', $_SESSION['uid'], 'system/user', $_SESSION['realname'].' upload image file '.$upload->new_filename, 'User image', 'Upload'); utility::jsAlert(__('Image Uploaded Successfully')); diff --git a/admin/modules/system/backup.php b/admin/modules/system/backup.php index c7e6fc09..0741622e 100755 --- a/admin/modules/system/backup.php +++ b/admin/modules/system/backup.php @@ -143,23 +143,15 @@ $table_spec = 'backup_log AS bl LEFT JOIN user AS u ON bl.user_id=u.user_id'; // create datagrid $datagrid = new simbio_datagrid(); -if ($can_read AND $can_write) { - $datagrid->setSQLColumn('bl.backup_log_id', - 'u.realname AS \''.__('Backup Executor').'\'', - 'bl.backup_time AS \''.__('Backup Time').'\'', - 'bl.backup_file AS \''.__('Backup File Location').'\'', - 'bl.backup_file AS \''.__('File Size').'\''); - $datagrid->setSQLorder('backup_time DESC'); - $datagrid->modifyColumnContent(4, 'callback{showFileSize}'); -}else{ - $datagrid->setSQLColumn( - 'u.realname AS \''.__('Backup Executor').'\'', +$datagrid->setSQLColumn('bl.backup_log_id', + 'u.realname AS \''.__('Backup Executor').'\'', 'bl.backup_time AS \''.__('Backup Time').'\'', 'bl.backup_file AS \''.__('Backup File Location').'\'', - 'bl.backup_file AS \''.__('File Size').'\''); - $datagrid->setSQLorder('backup_time DESC'); - $datagrid->modifyColumnContent(3, 'callback{showFileSize}'); -} + 'bl.backup_file AS \''.__('File Size').'\''); +$datagrid->setSQLorder('backup_time DESC'); +$datagrid->modifyColumnContent(4, 'callback{showFileSize}'); +if (!$can_write) $datagrid->invisible_fields = [0]; + // is there any search if (isset($_GET['keywords']) AND $_GET['keywords']) { $keywords = $dbs->escape_string($_GET['keywords']); diff --git a/admin/modules/system/biblio_indexer.inc.php b/admin/modules/system/biblio_indexer.inc.php index 24fc0b27..138bafe7 100755 --- a/admin/modules/system/biblio_indexer.inc.php +++ b/admin/modules/system/biblio_indexer.inc.php @@ -139,7 +139,7 @@ public function makeIndex($int_biblio_id) { $data['publish_place'] = $this->obj_db->escape_string($rb_id['publish_place']); $data['isbn_issn'] = $this->obj_db->escape_string($rb_id['isbn_issn']); $data['language'] = $this->obj_db->escape_string($rb_id['language']); - $data['publish_year'] = $rb_id['publish_year']; + $data['publish_year'] = $this->obj_db->escape_string($rb_id['publish_year']); $data['classification'] = $this->obj_db->escape_string($rb_id['classification']); $data['spec_detail_info'] = $this->obj_db->escape_string($rb_id['spec_detail_info']); $data['call_number'] = $this->obj_db->escape_string($rb_id['call_number']); diff --git a/admin/modules/system/envinfo.php b/admin/modules/system/envinfo.php index abd4e1a1..54b79058 100644 --- a/admin/modules/system/envinfo.php +++ b/admin/modules/system/envinfo.php @@ -47,6 +47,7 @@ // require SIMBIO.'simbio_DB/simbio_dbop.inc.php'; $environment = array( + array('title' => __('SLiMS Environment Mode'), 'desc' => ucfirst(ENVIRONMENT)), array('title' => __('SLiMS Version'), 'desc' => SENAYAN_VERSION_TAG), array('title' => __('Operating System'), 'desc' => php_uname('a')), array('title' => __('OS Architecture'), 'desc' => php_uname('m').' '.(8 * PHP_INT_SIZE).' bit'), diff --git a/admin/modules/system/envsetting.php b/admin/modules/system/envsetting.php new file mode 100644 index 00000000..41b24ce1 --- /dev/null +++ b/admin/modules/system/envsetting.php @@ -0,0 +1,145 @@ +setTimeout(() => {parent.$(\'#mainContent\').simbioAJAX(\'' . $_SERVER['PHP_SELF'] . '\')}, 5000)'; + // utility::jsAlert(json_encode($write)); + exit; +} + +?> + + + +submit_button_attr = 'name="saveData" value="'.__('Save Settings').'" class="btn btn-default"'; + +// form table attributes +$form->table_attr = 'id="dataList" class="s-table table"'; +$form->table_header_attr = 'class="alterCell font-weight-bold"'; +$form->table_content_attr = 'class="alterCell2"'; + +// Your Environment +if ($BasedIp) +{ + $thisEnv = ucfirst((!in_array(getCurrentIp(), $RangeIp) ? $Environment : $ConditionEnvironment)); + $HTML = <<{$thisEnv} + HTML; + $form->addAnything('Your Environment Mode', $HTML); + + $Environment = $ConditionEnvironment; +} + +// Environment List +$EnvOptions = [ + [1, __('Production')], + [0, __('Development')] + ]; +$form->addSelectList('env', __('System Environment Mode'), $EnvOptions, ( $Environment == 'production' ? 1 : 0 ) ,'class="form-control col-3"'); +$BasedIpOptions = [ + [0, __('Disable')], + [1, __('Enable')] +]; +$form->addSelectList('basedIp', __('Environment for some IP?'), $BasedIpOptions, ( $BasedIp ? 1 : 0 ) ,'class="form-control col-3"'); +$form->addTextField('textarea', 'rangeIp', __('Range Ip wil be impacted with Environment. Example : 10.120.33.40;20.100.34.10. '), implode(';', $RangeIp), 'style="margin-top: 0px; margin-bottom: 0px; height: 149px;" class="form-control" placeholder="Leave it empty, if you want to set environment to impact for all IP"'); +// print out the object +echo $form->printOut(); \ No newline at end of file diff --git a/admin/modules/system/holiday.php b/admin/modules/system/holiday.php index 80873180..822cdc74 100755 --- a/admin/modules/system/holiday.php +++ b/admin/modules/system/holiday.php @@ -55,12 +55,12 @@ // check form validity $holDesc = trim($dbs->escape_string(strip_tags($_POST['holDesc']))); if (empty($holDesc)) { - utility::jsAlert(__('Holiday description can\'t be empty!')); + utility::jsToastr(__('Holiday Settings'),__('Holiday description can\'t be empty!'),'warning'); exit(); } else { $data['holiday_date'] = trim($_POST['holDate']); // remove extra whitespace if(!preg_match('@^[0-9]{4}-[0-9]{2}-[0-9]{2}$@', $data['holiday_date'])) { - utility::jsAlert(__('Holiday Date Start must have the format YYYY-MM-DD!')); + utility::jsToastr(__('Holiday Settings'),__('Holiday Date Start must have the format YYYY-MM-DD!'),'warning'); exit(); } $holiday_start_date = $data['holiday_date']; @@ -75,28 +75,28 @@ $updateRecordID = (integer)$_POST['updateRecordID']; if ($sql_op->update('holiday', $data, 'holiday_id='.$updateRecordID)) { utility::writeLogs($dbs, 'staff', $_SESSION['uid'], 'System', $_SESSION['realname'].' update holiday date for '.$data['description'], 'Holiday', 'Update'); - utility::jsAlert(__('Holiday Data Successfully updated')); + utility::jsToastr(__('Holiday Settings'),__('Holiday Data Successfully updated'),'success'); // update holiday_dayname session $_SESSION['holiday_date'][$data['holiday_date']] = $data['holiday_date']; echo ''; exit(); } else { utility::writeLogs($dbs, 'staff', $_SESSION['uid'], 'System', $_SESSION['realname'].' failed update holiday data for '.$data['description'], 'Holiday', 'Fail'); - utility::jsAlert(__('Holiday FAILED to update. Please Contact System Administrator')."\n".$sql_op->error); + utility::jsToastr(__('Holiday Settings'),__('Holiday FAILED to update. Please Contact System Administrator')."\n".$sql_op->error,'error'); } } else { /* INSERT RECORD MODE */ // insert the data if ($sql_op->insert('holiday', $data)) { utility::writeLogs($dbs, 'staff', $_SESSION['uid'], 'System', $_SESSION['realname'].' add holiday date for '.$data['description'], 'Holiday', 'Add'); - utility::jsAlert(__('New Holiday Successfully Saved')); + utility::jsToastr(__('Holiday Settings'),__('New Holiday Successfully Saved'),'success'); // update holiday_dayname session $_SESSION['holiday_date'][$data['holiday_date']] = $data['holiday_date']; // date range insert if (!empty($_POST['holDateEnd'])) { $holiday_end_date = trim($_POST['holDateEnd']); // remove extra whitespace if(!preg_match('@^[0-9]{4}-[0-9]{2}-[0-9]{2}$@', $holiday_end_date)) { - utility::jsAlert(__('Holiday Date End must have the format YYYY-MM-DD if it is not empty!')); + utility::jsToastr(__('Holiday Settings'),__('Holiday Date End must have the format YYYY-MM-DD if it is not empty!'),'warning'); exit(); } // check if holiday end date is more than holiday start date @@ -121,7 +121,7 @@ exit(); } else { utility::writeLogs($dbs, 'staff', $_SESSION['uid'], 'System', $_SESSION['realname'].' failed to add holiday data for '.$data['description'], 'Holiday', 'Fail'); - utility::jsAlert(__('Holiday FAILED to Save. Please Contact System Administrator')."\n".$sql_op->error); + utility::jsToastr(__('Holiday Settings'),__('Holiday FAILED to Save. Please Contact System Administrator')."\n".$sql_op->error,'error'); } } } @@ -157,10 +157,10 @@ // error alerting if ($error_num == 0) { utility::writeLogs($dbs, 'staff', $_SESSION['uid'], 'System', $_SESSION['realname'].' remove holiday date with id '.$_log, 'Holiday', 'Delete'); - utility::jsAlert(__('All Data Successfully Deleted')); + utility::jsToastr(__('Holiday Settings'),__('All Data Successfully Deleted'),'success'); echo ''; } else { - utility::jsAlert(__('Some or All Data NOT deleted successfully!\nPlease contact system administrator')); + utility::jsToastr(__('Holiday Settings'),__('Some or All Data NOT deleted successfully!\nPlease contact system administrator'),'warning'); echo ''; } exit(); @@ -170,16 +170,15 @@ ?>