<?php/*TODO* Dynamic layout-unaware filtering* Replace usage of eval()* Dataset versioning* Make use of the column names in $_POST when building $arrayForJSON* Things depeding on the tablename: - require_once() should load the right file according to $tablename -* Return result of check_array() into 'exception'* Return 'exception' when there are no matches found* Fetching another dataset doesn't work when filtering is active - Fetching another buffered set needs to be combined with filters, currently when an filter is active and another dataset is fetched, the filter isn't resent, only the BufferedGrid values are sent - probably the datamodel needs some modifications*/ require_once('./data/init.php');// require_once('dokuarchiv/Patienten.php'); function check_array($array){ $check_result=array(); $check_result['valid']=true; $check_result['reasons']=array(); foreach($array as $field){ if(is_array($field)){ $test=check_array($field); $check_result['valid']=$test['valid']; } else{ if(preg_match('/\s+/', $field)){ $check_result['valid']=false; $check_result[count($check_result['reasons'])]="Found a possible SQL injection: " . $field; } if(preg_match('..', $field)){ $check_result['valid']=false; $check_result[count($check_result['reasons'])]="Directory traversal attempt detected" . $field; } } } return $check_result; }// Uncomment this for running it on the CLI:// $_POST=array(// 'dir'=>"ASC",// 'limit'=>"150",// 'start'=>"10",// 'sort'=>"Vorname",// 'filter'=>array()// );// $_POST['filter'][0]['data']['type']="string";// $_POST['filter'][0]['data']['value']="braun";// $_POST['filter'][0]['field']="Name"; $_POST['table']="Patienten"; $tablename=$_POST['table']; require_once('dokuarchiv/'.$tablename.'.php'); $check=check_array($_POST);// FIXME: Make the check work again// if(!$check['valid']){// return 1;// } $crit = new Criteria(); if($_POST['start']!==NULL && $_POST['limit']!==NULL){ $crit->setOffset($_POST['start']); $crit->setLimit($_POST['limit']); } if(isset($_POST['filter'])){ if($_POST['filter']!==NULL){ foreach($_POST['filter'] as $entry){ if($entry['data']['type']=="string"){ //echo "Filter by: " . $entry['data']['value'] . "\n"; $crit->add($tablename.".".$entry['field'], "%".$entry['data']['value']."%", Criteria::LIKE); } if($entry['data']['type']=="date"){ if($entry['data']['comparison']=="eq"){ $crit->add($tablename.".".$entry['field'], $entry['data']['value'], Criteria::EQUAL); } if($entry['data']['comparison']=="lt"){ $crit->add($tablename.".".$entry['field'], $entry['data']['value'], Criteria::LESS_THAN); } if($entry['data']['comparison']=="gt"){ $crit->add($tablename.".".$entry['field'], $entry['data']['value'], Criteria::GREATER_THAN); } } //echo "Filter handling not yet fully implemented\n"; } } } if($_POST['sort']!==NULL){ // only add the criteria, when sorting // of data is explicitely requested if($_POST['dir']!==NULL){ // make sure, the sorting direction // is given if($_POST['dir']=="ASC"){ $crit->addAscendingOrderByColumn($_POST['table'].".".$_POST['sort']); } else { $crit->addDescendingOrderByColumn($_POST['table'].".".$_POST['sort']); } } } $$tablename = PatientenPeer::doSelect($crit); //run the DB query $arrayForJSON['meta']=array( // add some metadata to the JSON string // I'm not yet sure what all of this fields // mean, but it looks like they're needed 'code' => "0", 'exception' => array(), 'success' => "true", 'message' => "" );// $arrayForJSON['meta']['exception'][0]="FooBar"; $counter=0; $critcopy = clone $crit; $critcopy->setLimit(NULL); $critcopy->setOffset(NULL); $arrayForJSON['data']['total']="".PatientenPeer::doCount($critcopy).""; if($_POST['filter']===NULL){ // TODO: This doesn't help, when there happen changes // to the datasets in the DB - proper versioning support // for the extJS grid needs to be implemented in another way $arrayForJSON['data']['results']['version']="1"; } else{ $arrayForJSON['data']['results']['version']=time(); } //$testvar=eval($tablename."Peer::doCount(new Criteria());"); // FIXME: eval() is evil() //$arrayForJSON['data']['total']="490"; foreach($$tablename as $entry){ $arrayForJSON['data']['results']['items'][$counter]=array( 'ID' => $entry->getId(), 'Name' => $entry->getName(), 'Vorname' => $entry->getVorname(), 'Geburtsdatum' => $entry->getGeburtsdatum('d.m.Y') ); $counter++; } echo json_encode($arrayForJSON)."\n";?>