diff --git a/.htaccess b/.htaccess
index 6c370407..c7c01254 100755
--- a/.htaccess
+++ b/.htaccess
@@ -6,6 +6,13 @@
Order allow,deny
+
+ RewriteEngine On
+ # Protect hidden directory from vulnerability scanner
+ RewriteRule (^|/)\.([^/]+)(/|$) - [L,F]
+ RewriteRule (^|/)([^/]+)~(/|$) - [L,F]
+
+
# Don't show directory listings for URLs which map to a directory.
Options -Indexes
diff --git a/admin/admin_template/akasia-dz/index_template.inc.php b/admin/admin_template/akasia-dz/index_template.inc.php
index 3ee56264..4c2bb8dc 100644
--- a/admin/admin_template/akasia-dz/index_template.inc.php
+++ b/admin/admin_template/akasia-dz/index_template.inc.php
@@ -86,7 +86,15 @@
diff --git a/admin/admin_template/akasia/index_template.inc.php b/admin/admin_template/akasia/index_template.inc.php
index 8d3b7d77..cda818f6 100755
--- a/admin/admin_template/akasia/index_template.inc.php
+++ b/admin/admin_template/akasia/index_template.inc.php
@@ -85,7 +85,15 @@
@@ -294,4 +294,4 @@
let fileName = $(this).val().replace(/\\/g, '/').replace(/.*\//, '');
$(this).parent('.custom-file').find('.custom-file-label').text(fileName);
});
-
\ No newline at end of file
+
diff --git a/admin/modules/bibliography/index.php b/admin/modules/bibliography/index.php
index f9f80b8b..a264df64 100755
--- a/admin/modules/bibliography/index.php
+++ b/admin/modules/bibliography/index.php
@@ -226,8 +226,15 @@ function getimagesizefromstring($string_data)
$image_upload->setAllowableFormat($sysconf['allowed_images']);
$image_upload->setMaxSize($sysconf['max_image_upload'] * 1024);
$image_upload->setUploadDir(IMGBS . 'docs');
+
+ $img_title = $data['title'].'_'.date("YmdHis");
+ if(strlen($data['title']) > 70){
+ $img_title = substr($data['title'], 0, 70).'_'.date("YmdHis");
+ }
+
+ $new_filename = strtolower('cover_'. preg_replace("/[^a-zA-Z0-9]+/", "-", $img_title));
// upload the file and change all space characters to underscore
- $img_upload_status = $image_upload->doUpload('image', preg_replace('@\s+@i', '_', $_FILES['image']['name']));
+ $img_upload_status = $image_upload->doUpload('image', $new_filename);
if ($img_upload_status == UPLOAD_SUCCESS) {
$data['image'] = $dbs->escape_string($image_upload->new_filename);
// write log
@@ -235,8 +242,9 @@ function getimagesizefromstring($string_data)
utility::jsToastr('Bibliography', __('Image Uploaded Successfully'), 'success');
} else {
// write log
+ $data['image'] = NULL;
utility::writeLogs($dbs, 'staff', $_SESSION['uid'], 'bibliography', 'ERROR : ' . $_SESSION['realname'] . ' FAILED TO upload image file ' . $image_upload->new_filename . ', with error (' . $image_upload->error . ')');
- utility::jsToastr('Bibliography', __('Image Uploaded Failed'), 'error');
+ utility::jsToastr('Bibliography', __('Image Uploaded Failed').'
'.$image_upload->error, 'error');
}
} else if (!empty($_POST['base64picstring'])) {
list($filedata, $filedom) = explode('#image/type#', $_POST['base64picstring']);
diff --git a/admin/modules/bibliography/item_import.php b/admin/modules/bibliography/item_import.php
index 42a12552..f0531f3a 100755
--- a/admin/modules/bibliography/item_import.php
+++ b/admin/modules/bibliography/item_import.php
@@ -133,30 +133,39 @@
$item_status = utility::getID($dbs, 'mst_item_status', 'item_status_id', 'item_status_name', $field[9], $stat_id_cache);
$item_status = $item_status?'\''.$item_status.'\'':'NULL';
$site = $field[10]?'\''.$field[10].'\'':'NULL';
- $source = $field[11]?'\''.$field[11].'\'':'NULL';
+ $source = $field[11]?'\''.$field[11].'\'':'0';
$invoice = $field[12]?'\''.$field[12].'\'':'NULL';
$price = $field[13]?'\''.$field[13].'\'':'NULL';
$price_currency = $field[14]?'\''.$field[14].'\'':'NULL';
$invoice_date = $field[15]?'\''.$field[15].'\'':'NULL';
- $input_date = '\''.$field[16].'\'';
- $last_update = '\''.$field[17].'\'';
-
- // sql insert string
- $sql_str = "INSERT INTO item (item_code, call_number, coll_type_id,
- inventory_code, received_date, supplier_id,
- order_no, location_id, order_date, item_status_id, site,
- source, invoice, price, price_currency, invoice_date,
- input_date, last_update)
- VALUES ($item_code, $call_number, $coll_type,
- $inventory_code, $received_date, $supplier,
- $order_no, $location, $order_date, $item_status, $site,
- $source, $invoice, $price, $price_currency, $invoice_date,
- $input_date, $last_update)";
+ $input_date = $field[16]?'\''.$field[16].'\'':'\''.date('Y-m-d H:i:s').'\'';
+ $last_update = $field[17]?'\''.$field[17].'\'':'\''.date('Y-m-d H:i:s').'\'';
+ $title = $field[18];
// first field is header
if (isset($_POST['header']) && $n < 1) {
$n++;
+ continue;
} else {
+
+ // get biblio_id
+ $b_q = $dbs->query(sprintf("select biblio_id from biblio where title = '%s'", $title));
+ if($b_q->num_rows < 1) continue;
+ $b_d = $b_q->fetch_row();
+ $biblio_id = $b_d[0];
+
+ // sql insert string
+ $sql_str = "INSERT INTO item (biblio_id, item_code, call_number, coll_type_id,
+ inventory_code, received_date, supplier_id,
+ order_no, location_id, order_date, item_status_id, site,
+ source, invoice, price, price_currency, invoice_date,
+ input_date, last_update)
+ VALUES ($biblio_id, $item_code, $call_number, $coll_type,
+ $inventory_code, $received_date, $supplier,
+ $order_no, $location, $order_date, $item_status, $site,
+ $source, $invoice, $price, $price_currency, $invoice_date,
+ $input_date, $last_update)";
+
// send query
// die($sql_str);
$dbs->query($sql_str);
diff --git a/admin/modules/bibliography/marcexport.php b/admin/modules/bibliography/marcexport.php
index 8fbf72cb..7729472e 100644
--- a/admin/modules/bibliography/marcexport.php
+++ b/admin/modules/bibliography/marcexport.php
@@ -216,14 +216,14 @@
require LIB.'biblio_list_index.inc.php';
}
// table spec
- $table_spec = 'search_biblio';
+ $table_spec = 'search_biblio AS `index`';
$datagrid->setSQLColumn('biblio_id',
'title AS \''.__('Title').'\'',
'author AS \''.__('Author').'\'');
} else {
require LIB.'biblio_list.inc.php';
// table spec
- $table_spec = 'search_biblio';
+ $table_spec = 'search_biblio AS `index`';
$datagrid->setSQLColumn('biblio_id',
'title AS \''.__('Title').'\'',
'author AS \''.__('Author').'\'');
diff --git a/admin/modules/bibliography/pop_attach.php b/admin/modules/bibliography/pop_attach.php
index 8cb9a2fb..487b6913 100755
--- a/admin/modules/bibliography/pop_attach.php
+++ b/admin/modules/bibliography/pop_attach.php
@@ -88,6 +88,8 @@
$fdata['file_url'] = $dbs->escape_string($url);
$fdata['file_dir'] = $dbs->escape_string($file_dir);
$fdata['file_desc'] = $dbs->escape_string(trim(strip_tags($_POST['fileDesc'])));
+ if(isset($_POST['fileKey']) && trim($_POST['fileKey']) !== '')
+ $fdata['file_key'] = $dbs->escape_string(trim(strip_tags($_POST['fileKey'])));
$fdata['mime_type'] = $sysconf['mimetype'][$file_ext];
$fdata['input_date'] = date('Y-m-d H:i:s');
$fdata['last_update'] = $fdata['input_date'];
@@ -110,6 +112,8 @@
$fdata['file_url'] = $dbs->escape_string($fdata['file_name']);
$fdata['file_dir'] = 'literal{NULL}';
$fdata['file_desc'] = $dbs->escape_string(trim(strip_tags($_POST['fileDesc'])));
+ if(isset($_POST['fileKey']) && trim($_POST['fileKey']) !== '')
+ $fdata['file_key'] = $dbs->escape_string(trim(strip_tags($_POST['fileKey'])));
$fdata['mime_type'] = 'text/uri-list';
$fdata['input_date'] = date('Y-m-d H:i:s');
$fdata['last_update'] = $fdata['input_date'];
@@ -144,7 +148,10 @@
// file biblio access update
$update1 = $sql_op->update('biblio_attachment', array('access_type' => $data['access_type'], 'access_limit' => $data['access_limit'], 'placement' => $data['placement']), 'biblio_id='.$updateBiblioID.' AND file_id='.$fileID);
// file description update
- $update2 = $sql_op->update('files', array('file_title' => $title, 'file_url' => $url, 'file_desc' => $dbs->escape_string(trim($_POST['fileDesc']))), 'file_id='.$fileID);
+ $file_desc_update = array('file_title' => $title, 'file_url' => $url, 'file_desc' => $dbs->escape_string(trim($_POST['fileDesc'])));
+ if(isset($_POST['fileKey']))
+ $file_desc_update['file_key'] = $dbs->escape_string(trim(strip_tags($_POST['fileKey'])));
+ $update2 = $sql_op->update('files', $file_desc_update, 'file_id='.$fileID);
if ($update1) {
utility::jsToastr('File Attachment', __('File Attachment data updated!'), 'success');
echo '';
+ $xlsquery = "SELECT i.item_code AS '" . __('Item Code') . "',
+ b.title AS '" . __('Title') . "',
+ ct.coll_type_name AS '" . __('Collection Type') . "',
+ i.item_status_id AS '" . __('Item Status') . "',
+ b.call_number AS '" . __('Call Number') . "' FROM " .
+ $table_spec . " WHERE " . $criteria;
+ // echo $xlsquery;
+ unset($_SESSION['xlsdata']);
+ $_SESSION['xlsquery'] = $xlsquery;
+ $_SESSION['tblout'] = "title_list_item";
+
$content = ob_get_clean();
// include the page template
- require SB.'/admin/'.$sysconf['admin_template']['dir'].'/printed_page_tpl.php';
+ require SB . '/admin/' . $sysconf['admin_template']['dir'] . '/printed_page_tpl.php';
}
diff --git a/admin/modules/system/app_user.php b/admin/modules/system/app_user.php
index 6ff5be94..ab99f29d 100755
--- a/admin/modules/system/app_user.php
+++ b/admin/modules/system/app_user.php
@@ -74,6 +74,8 @@ function getUserType($obj_db, $array_data, $col) {
if ($query_image->num_rows > 0) {
$_delete = $dbs->query(sprintf('UPDATE user SET user_image=NULL WHERE user_id=%d', $_POST['uimg']));
if ($_delete) {
+ // Change upict
+ $_SESSION['upict'] = 'person.png';
$postImage = stripslashes($_POST['img']);
$postImage = str_replace('/', '', $postImage);
@unlink(sprintf(IMGBS.'persons/%s', $postImage));
@@ -177,6 +179,8 @@ function getUserType($obj_db, $array_data, $col) {
// upload status alert
if (isset($upload_status)) {
if ($upload_status == UPLOAD_SUCCESS) {
+ // Change upict
+ $_SESSION['upict'] = $data['user_image'];
// write log
utility::writeLogs($dbs, 'staff', $_SESSION['uid'], 'system/user', $_SESSION['realname'].' upload image file '.$upload->new_filename, 'User image', 'Upload');
utility::jsAlert(__('Image Uploaded Successfully'));
@@ -200,6 +204,8 @@ function getUserType($obj_db, $array_data, $col) {
// upload status alert
if (isset($upload_status)) {
if ($upload_status == UPLOAD_SUCCESS) {
+ // Change upict
+ $_SESSION['upict'] = $data['user_image'];
// write log
utility::writeLogs($dbs, 'staff', $_SESSION['uid'], 'system/user', $_SESSION['realname'].' upload image file '.$upload->new_filename, 'User image', 'Upload');
utility::jsAlert(__('Image Uploaded Successfully'));
diff --git a/admin/modules/system/backup.php b/admin/modules/system/backup.php
index c7e6fc09..0741622e 100755
--- a/admin/modules/system/backup.php
+++ b/admin/modules/system/backup.php
@@ -143,23 +143,15 @@
$table_spec = 'backup_log AS bl LEFT JOIN user AS u ON bl.user_id=u.user_id';
// create datagrid
$datagrid = new simbio_datagrid();
-if ($can_read AND $can_write) {
- $datagrid->setSQLColumn('bl.backup_log_id',
- 'u.realname AS \''.__('Backup Executor').'\'',
- 'bl.backup_time AS \''.__('Backup Time').'\'',
- 'bl.backup_file AS \''.__('Backup File Location').'\'',
- 'bl.backup_file AS \''.__('File Size').'\'');
- $datagrid->setSQLorder('backup_time DESC');
- $datagrid->modifyColumnContent(4, 'callback{showFileSize}');
-}else{
- $datagrid->setSQLColumn(
- 'u.realname AS \''.__('Backup Executor').'\'',
+$datagrid->setSQLColumn('bl.backup_log_id',
+ 'u.realname AS \''.__('Backup Executor').'\'',
'bl.backup_time AS \''.__('Backup Time').'\'',
'bl.backup_file AS \''.__('Backup File Location').'\'',
- 'bl.backup_file AS \''.__('File Size').'\'');
- $datagrid->setSQLorder('backup_time DESC');
- $datagrid->modifyColumnContent(3, 'callback{showFileSize}');
-}
+ 'bl.backup_file AS \''.__('File Size').'\'');
+$datagrid->setSQLorder('backup_time DESC');
+$datagrid->modifyColumnContent(4, 'callback{showFileSize}');
+if (!$can_write) $datagrid->invisible_fields = [0];
+
// is there any search
if (isset($_GET['keywords']) AND $_GET['keywords']) {
$keywords = $dbs->escape_string($_GET['keywords']);
diff --git a/admin/modules/system/biblio_indexer.inc.php b/admin/modules/system/biblio_indexer.inc.php
index 24fc0b27..138bafe7 100755
--- a/admin/modules/system/biblio_indexer.inc.php
+++ b/admin/modules/system/biblio_indexer.inc.php
@@ -139,7 +139,7 @@ public function makeIndex($int_biblio_id) {
$data['publish_place'] = $this->obj_db->escape_string($rb_id['publish_place']);
$data['isbn_issn'] = $this->obj_db->escape_string($rb_id['isbn_issn']);
$data['language'] = $this->obj_db->escape_string($rb_id['language']);
- $data['publish_year'] = $rb_id['publish_year'];
+ $data['publish_year'] = $this->obj_db->escape_string($rb_id['publish_year']);
$data['classification'] = $this->obj_db->escape_string($rb_id['classification']);
$data['spec_detail_info'] = $this->obj_db->escape_string($rb_id['spec_detail_info']);
$data['call_number'] = $this->obj_db->escape_string($rb_id['call_number']);
diff --git a/admin/modules/system/envinfo.php b/admin/modules/system/envinfo.php
index abd4e1a1..54b79058 100644
--- a/admin/modules/system/envinfo.php
+++ b/admin/modules/system/envinfo.php
@@ -47,6 +47,7 @@
// require SIMBIO.'simbio_DB/simbio_dbop.inc.php';
$environment = array(
+ array('title' => __('SLiMS Environment Mode'), 'desc' => ucfirst(ENVIRONMENT)),
array('title' => __('SLiMS Version'), 'desc' => SENAYAN_VERSION_TAG),
array('title' => __('Operating System'), 'desc' => php_uname('a')),
array('title' => __('OS Architecture'), 'desc' => php_uname('m').' '.(8 * PHP_INT_SIZE).' bit'),
diff --git a/admin/modules/system/envsetting.php b/admin/modules/system/envsetting.php
new file mode 100644
index 00000000..41b24ce1
--- /dev/null
+++ b/admin/modules/system/envsetting.php
@@ -0,0 +1,145 @@
+setTimeout(() => {parent.$(\'#mainContent\').simbioAJAX(\'' . $_SERVER['PHP_SELF'] . '\')}, 5000)';
+ // utility::jsAlert(json_encode($write));
+ exit;
+}
+
+?>
+
+
+
+submit_button_attr = 'name="saveData" value="'.__('Save Settings').'" class="btn btn-default"';
+
+// form table attributes
+$form->table_attr = 'id="dataList" class="s-table table"';
+$form->table_header_attr = 'class="alterCell font-weight-bold"';
+$form->table_content_attr = 'class="alterCell2"';
+
+// Your Environment
+if ($BasedIp)
+{
+ $thisEnv = ucfirst((!in_array(getCurrentIp(), $RangeIp) ? $Environment : $ConditionEnvironment));
+ $HTML = <<{$thisEnv}
+ HTML;
+ $form->addAnything('Your Environment Mode', $HTML);
+
+ $Environment = $ConditionEnvironment;
+}
+
+// Environment List
+$EnvOptions = [
+ [1, __('Production')],
+ [0, __('Development')]
+ ];
+$form->addSelectList('env', __('System Environment Mode'), $EnvOptions, ( $Environment == 'production' ? 1 : 0 ) ,'class="form-control col-3"');
+$BasedIpOptions = [
+ [0, __('Disable')],
+ [1, __('Enable')]
+];
+$form->addSelectList('basedIp', __('Environment for some IP?'), $BasedIpOptions, ( $BasedIp ? 1 : 0 ) ,'class="form-control col-3"');
+$form->addTextField('textarea', 'rangeIp', __('Range Ip wil be impacted with Environment. Example : 10.120.33.40;20.100.34.10. '), implode(';', $RangeIp), 'style="margin-top: 0px; margin-bottom: 0px; height: 149px;" class="form-control" placeholder="Leave it empty, if you want to set environment to impact for all IP"');
+// print out the object
+echo $form->printOut();
\ No newline at end of file
diff --git a/admin/modules/system/holiday.php b/admin/modules/system/holiday.php
index 80873180..822cdc74 100755
--- a/admin/modules/system/holiday.php
+++ b/admin/modules/system/holiday.php
@@ -55,12 +55,12 @@
// check form validity
$holDesc = trim($dbs->escape_string(strip_tags($_POST['holDesc'])));
if (empty($holDesc)) {
- utility::jsAlert(__('Holiday description can\'t be empty!'));
+ utility::jsToastr(__('Holiday Settings'),__('Holiday description can\'t be empty!'),'warning');
exit();
} else {
$data['holiday_date'] = trim($_POST['holDate']); // remove extra whitespace
if(!preg_match('@^[0-9]{4}-[0-9]{2}-[0-9]{2}$@', $data['holiday_date'])) {
- utility::jsAlert(__('Holiday Date Start must have the format YYYY-MM-DD!'));
+ utility::jsToastr(__('Holiday Settings'),__('Holiday Date Start must have the format YYYY-MM-DD!'),'warning');
exit();
}
$holiday_start_date = $data['holiday_date'];
@@ -75,28 +75,28 @@
$updateRecordID = (integer)$_POST['updateRecordID'];
if ($sql_op->update('holiday', $data, 'holiday_id='.$updateRecordID)) {
utility::writeLogs($dbs, 'staff', $_SESSION['uid'], 'System', $_SESSION['realname'].' update holiday date for '.$data['description'], 'Holiday', 'Update');
- utility::jsAlert(__('Holiday Data Successfully updated'));
+ utility::jsToastr(__('Holiday Settings'),__('Holiday Data Successfully updated'),'success');
// update holiday_dayname session
$_SESSION['holiday_date'][$data['holiday_date']] = $data['holiday_date'];
echo '';
exit();
} else {
utility::writeLogs($dbs, 'staff', $_SESSION['uid'], 'System', $_SESSION['realname'].' failed update holiday data for '.$data['description'], 'Holiday', 'Fail');
- utility::jsAlert(__('Holiday FAILED to update. Please Contact System Administrator')."\n".$sql_op->error);
+ utility::jsToastr(__('Holiday Settings'),__('Holiday FAILED to update. Please Contact System Administrator')."\n".$sql_op->error,'error');
}
} else {
/* INSERT RECORD MODE */
// insert the data
if ($sql_op->insert('holiday', $data)) {
utility::writeLogs($dbs, 'staff', $_SESSION['uid'], 'System', $_SESSION['realname'].' add holiday date for '.$data['description'], 'Holiday', 'Add');
- utility::jsAlert(__('New Holiday Successfully Saved'));
+ utility::jsToastr(__('Holiday Settings'),__('New Holiday Successfully Saved'),'success');
// update holiday_dayname session
$_SESSION['holiday_date'][$data['holiday_date']] = $data['holiday_date'];
// date range insert
if (!empty($_POST['holDateEnd'])) {
$holiday_end_date = trim($_POST['holDateEnd']); // remove extra whitespace
if(!preg_match('@^[0-9]{4}-[0-9]{2}-[0-9]{2}$@', $holiday_end_date)) {
- utility::jsAlert(__('Holiday Date End must have the format YYYY-MM-DD if it is not empty!'));
+ utility::jsToastr(__('Holiday Settings'),__('Holiday Date End must have the format YYYY-MM-DD if it is not empty!'),'warning');
exit();
}
// check if holiday end date is more than holiday start date
@@ -121,7 +121,7 @@
exit();
} else {
utility::writeLogs($dbs, 'staff', $_SESSION['uid'], 'System', $_SESSION['realname'].' failed to add holiday data for '.$data['description'], 'Holiday', 'Fail');
- utility::jsAlert(__('Holiday FAILED to Save. Please Contact System Administrator')."\n".$sql_op->error);
+ utility::jsToastr(__('Holiday Settings'),__('Holiday FAILED to Save. Please Contact System Administrator')."\n".$sql_op->error,'error');
}
}
}
@@ -157,10 +157,10 @@
// error alerting
if ($error_num == 0) {
utility::writeLogs($dbs, 'staff', $_SESSION['uid'], 'System', $_SESSION['realname'].' remove holiday date with id '.$_log, 'Holiday', 'Delete');
- utility::jsAlert(__('All Data Successfully Deleted'));
+ utility::jsToastr(__('Holiday Settings'),__('All Data Successfully Deleted'),'success');
echo '';
} else {
- utility::jsAlert(__('Some or All Data NOT deleted successfully!\nPlease contact system administrator'));
+ utility::jsToastr(__('Holiday Settings'),__('Some or All Data NOT deleted successfully!\nPlease contact system administrator'),'warning');
echo '';
}
exit();
@@ -170,16 +170,15 @@
?>