diff --git a/web/zm_funcs.php b/web/zm_funcs.php index 51c974a72..2ccda8759 100644 --- a/web/zm_funcs.php +++ b/web/zm_funcs.php @@ -1218,20 +1218,20 @@ function parseFilter( &$filter, $save_to_session=false, $term_sep='&' ) { if ( isset($filter['terms'][$i]['cnj']) ) { - $filter['query'] .= $term_sep."filter[terms][$i][cnj]=".$filter['terms'][$i]['cnj']; + $filter['query'] .= $term_sep."filter[terms][$i][cnj]=".urlencode($filter['terms'][$i]['cnj']); $filter['sql'] .= " ".$filter['terms'][$i]['cnj']." "; - $filter['fields'] .= "\n"; + $filter['fields'] .= "\n"; } if ( isset($filter['terms'][$i]['obr']) ) { - $filter['query'] .= $term_sep."filter[terms][$i][obr]=".$filter['terms'][$i]['obr']; + $filter['query'] .= $term_sep."filter[terms][$i][obr]=".urlencode($filter['terms'][$i]['obr']); $filter['sql'] .= " ".str_repeat( "(", $filter['terms'][$i]['obr'] )." "; - $filter['fields'] .= "\n"; + $filter['fields'] .= "\n"; } if ( isset($filter['terms'][$i]['attr']) ) { - $filter['query'] .= $term_sep."filter[terms][$i][attr]=".$filter['terms'][$i]['attr']; - $filter['fields'] .= "\n"; + $filter['query'] .= $term_sep."filter[terms][$i][attr]=".urlencode($filter['terms'][$i]['attr']); + $filter['fields'] .= "\n"; switch ( $filter['terms'][$i]['attr'] ) { case 'MonitorName': @@ -1282,7 +1282,7 @@ function parseFilter( &$filter, $save_to_session=false, $term_sep='&' ) case 'Name': case 'Cause': case 'Notes': - $value = "'$value'"; + $value = "'".dbEscape($value)."'"; break; case 'DateTime': $value = "'".strftime( STRF_FMT_DATETIME_DB, strtotime( $value ) )."'"; @@ -1321,16 +1321,16 @@ function parseFilter( &$filter, $save_to_session=false, $term_sep='&' ) break; } - $filter['query'] .= $term_sep."filter[terms][$i][op]=".$filter['terms'][$i]['op']; - $filter['fields'] .= "\n"; - $filter['query'] .= $term_sep."filter[terms][$i][val]=".urlencode($filter['terms'][$i]['val']); - $filter['fields'] .= "\n"; + $filter['query'] .= $term_sep."filter[terms][$i][op]=".urlencode($filter['terms'][$i]['op']); + $filter['fields'] .= "\n"; + $filter['query'] .= $term_sep."filter[terms][$i][val]=".urlencode(urlencode($filter['terms'][$i]['val'])); + $filter['fields'] .= "\n"; } if ( isset($filter['terms'][$i]['cbr']) ) { - $filter['query'] .= $term_sep."filter[terms][$i][cbr]=".$filter['terms'][$i]['cbr']; + $filter['query'] .= $term_sep."filter[terms][$i][cbr]=".urlencode($filter['terms'][$i]['cbr']); $filter['sql'] .= " ".str_repeat( ")", $filter['terms'][$i]['cbr'] )." "; - $filter['fields'] .= "\n"; + $filter['fields'] .= "\n"; } } if ( $filter['sql'] ) diff --git a/web/zm_html_view_event.php b/web/zm_html_view_event.php index d525208fc..768408700 100644 --- a/web/zm_html_view_event.php +++ b/web/zm_html_view_event.php @@ -46,7 +46,7 @@ $event = dbFetchOne( $sql ); parseSort(); parseFilter( $filter ); -$sql = "select E.* from Events as E inner join Monitors as M on E.MonitorId = M.Id where $sort_column ".($sort_order=='asc'?'<=':'>=')." '".$event[preg_replace( '/^.*\./', '', $sort_column )]."'$filter_sql$mid_sql order by $sort_column ".($sort_order=='asc'?'desc':'asc'); +$sql = "select E.* from Events as E inner join Monitors as M on E.MonitorId = M.Id where $sort_column ".($sort_order=='asc'?'<=':'>=')." '".$event[preg_replace( '/^.*\./', '', $sort_column )]."'".$filter['sql'].$mid_sql." order by $sort_column ".($sort_order=='asc'?'desc':'asc')." limit 100"; $result = dbQuery( $sql ); foreach( dbFetchAll( $sql ) as $row ) while ( $row = dbFetchNext( $result ) ) @@ -58,7 +58,7 @@ while ( $row = dbFetchNext( $result ) ) } } -$sql = "select E.* from Events as E inner join Monitors as M on E.MonitorId = M.Id where $sort_column ".($sort_order=='asc'?'>=':'<=')." '".$event[preg_replace( '/^.*\./', '', $sort_column )]."'$filter_sql$mid_sql order by $sort_column $sort_order"; +$sql = "select E.* from Events as E inner join Monitors as M on E.MonitorId = M.Id where $sort_column ".($sort_order=='asc'?'>=':'<=')." '".$event[preg_replace( '/^.*\./', '', $sort_column )]."'".$filter['sql'].$mid_sql." order by $sort_column $sort_order limit 100"; $result = dbQuery( $sql ); while ( $row = dbFetchNext( $result ) ) { @@ -208,7 +208,7 @@ if ( $mode == "stream" ) -= $filter_fields ?> += $filter['fields'] ?> @@ -234,7 +234,7 @@ Learn Pref: -= $filter_fields ?> += $filter['fields'] ?> @@ -249,24 +249,24 @@ Learn Pref: = $zmSlangReplay ?> -= $zmSlangAll ?> += $zmSlangAll ?> -= $zmSlangPaged ?> += $zmSlangPaged ?> = $zmSlangDelete ?> = $zmSlangEdit ?> = $zmSlangExport ?> -= $zmSlangUnarchive ?> += $zmSlangUnarchive ?> -= $zmSlangArchive ?> += $zmSlangArchive ?> -= $zmSlangStills ?> += $zmSlangStills ?> -= $zmSlangStream ?> += $zmSlangStream ?> = $zmSlangVideo ?> @@ -294,11 +294,11 @@ if ( $mode == "still" && $paged && !empty($page) ) if ( false && $page > 2 ) { ?> -<< +<< -< +< -= $new_page ?> += $new_page ?> - = $new_page ?> + = $new_page ?> - > + > - >> + >> - + @@ -480,11 +480,11 @@ else ?> -= $zmSlangPrev ?> -= $zmSlangDeleteAndPrev ?> -= $zmSlangStop ?>= $zmSlangPlayAll ?> -= $zmSlangDeleteAndNext ?> -= $zmSlangNext ?> += $zmSlangPrev ?> += $zmSlangDeleteAndPrev ?> += $zmSlangStop ?>= $zmSlangPlayAll ?> += $zmSlangDeleteAndNext ?> += $zmSlangNext ?> @@ -497,7 +497,7 @@ if ( $mode == "stream" ) if ( $play && $next_event ) { ?> -var timeout_id = window.setTimeout( "window.location.replace( '= $PHP_SELF ?>?view== $view ?>&mode== $mode ?>&eid== $next_event['Id'] ?>= $filter_query ?>= $sort_query ?>&limit== $limit ?>&page== $page ?>&rate== $rate ?>&scale== $scale ?>&play=1' );", = ($frame_data['RealDuration']+1)*1000 ?> ); +var timeout_id = window.setTimeout( "window.location.replace( '= $PHP_SELF ?>?view== $view ?>&mode== $mode ?>&eid== $next_event['Id'] ?>= $filter['query'] ?>= $sort_query ?>&limit== $limit ?>&page== $page ?>&rate== $rate ?>&scale== $scale ?>&play=1' );", = ($frame_data['RealDuration']+1)*1000 ?> ); '; $filter_sql = parseTreeToSQL( $tree ); $temp_min_time = $temp_max_time = $temp_expandable = false; extractDatetimeRange( $tree, $temp_min_time, $temp_max_time, $temp_expandable ); - //echo $filter_sql; - //echo ''; if ( $filter_sql ) { @@ -265,8 +260,6 @@ if ( $tree ) { $filter_query = '&'.$filter_query; } - //echo $filter_query; - //echo ''; } $scales = array( diff --git a/web/zm_xhtml_view_event.php b/web/zm_xhtml_view_event.php index 6b53999f6..643afe18c 100644 --- a/web/zm_xhtml_view_event.php +++ b/web/zm_xhtml_view_event.php @@ -54,7 +54,7 @@ elseif ( isset( $fid ) ) parseSort( true, '&' ); parseFilter( true, '&' ); -$sql = "select E.* from Events as E inner join Monitors as M on E.MonitorId = M.Id where $sort_column ".($sort_order=='asc'?'<=':'>=')." '".$event[$sort_field]."'$filter_sql$mid_sql order by $sort_column ".($sort_order=='asc'?'desc':'asc'); +$sql = "select E.* from Events as E inner join Monitors as M on E.MonitorId = M.Id where $sort_column ".($sort_order=='asc'?'<=':'>=')." '".$event[$sort_field]."'".$filter['sql'].$mid_sql". order by $sort_column ".($sort_order=='asc'?'desc':'asc'); $result = dbQuery( $sql ); while ( $row = dbFetchNext( $result ) ) { @@ -65,7 +65,7 @@ while ( $row = dbFetchNext( $result ) ) } } -$sql = "select E.* from Events as E inner join Monitors as M on E.MonitorId = M.Id where $sort_column ".($sort_order=='asc'?'>=':'<=')." '".$event[$sort_field]."'$filter_sql$mid_sql order by $sort_column $sort_order"; +$sql = "select E.* from Events as E inner join Monitors as M on E.MonitorId = M.Id where $sort_column ".($sort_order=='asc'?'>=':'<=')." '".$event[$sort_field]."'".$filter['sql'].$mid_sql." order by $sort_column $sort_order"; $result = dbQuery( $sql ); while ( $row = dbFetchNext( $result ) ) { @@ -91,7 +91,7 @@ $paged = $event['Frames'] > $frames_per_page; = makeLink( "$PHP_SELF?view=eventdetails&eid=$eid", $event['Name'].($event['Archived']?'*':''), canEdit( 'Events' ) ) ?> -= $zmSlangDelete ?> += $zmSlangDelete ?> 2 ) { ?> -<< +<< -< +< -= $new_page ?> += $new_page ?> -= $new_page ?> += $new_page ?> -> +> ->> +>> $limit ) if ( false && $page > 2 ) { ?> -<< +<< -< +< $limit ) foreach ( $new_pages as $new_page ) { ?> -= $new_page ?> += $new_page ?> $limit ) foreach ( $new_pages as $new_page ) { ?> -= $new_page ?> += $new_page ?> -> +> ->> +>>