Added last access handling.

[timetracker.git] / WEB-INF / lib / common.lib.php

diff --git a/WEB-INF/lib/common.lib.php b/WEB-INF/lib/common.lib.php
index 905f10d..3dce388 100644 (file)
--- a/WEB-INF/lib/common.lib.php
+++ b/WEB-INF/lib/common.lib.php
@@ -26,17 +26,12 @@
 // | https://www.anuko.com/time_tracker/credits.htm
 // +----------------------------------------------------------------------+
 
-       /**
-        * @return unknown
-        * @param file unknown
-        * @param version = "" unknown
-        * @desc Loads a class
-        */
-       function import($class_name) {
-           $libs = array(
-                       dirname($_SERVER["SCRIPT_FILENAME"]),
-                       LIBRARY_DIR
-               );
+// import() function loads a class.
+function import($class_name) {
+  $libs = array(
+    dirname($_SERVER["SCRIPT_FILENAME"]),
+    LIBRARY_DIR
+  );
 
            $pos = strpos($class_name, ".");
         if (!($pos === false)) {
@@ -61,7 +56,7 @@
 
                print '<br><b>load_class: error loading file "'.$filename.'"</b>';
                die();
-       }
+}
 
        // The mu_sort function is used to sort a multi-dimensional array.
        // It looks like the code example is taken from the PHP manual http://ca2.php.net/manual/en/function.sort.php
@@ -127,7 +122,6 @@
                        die($mdb2->getMessage());
                        }
 
-                       $mdb2->setOption('debug', true);
                        $mdb2->setFetchMode(MDB2_FETCHMODE_ASSOC);
                        
                        $GLOBALS["_MDB2_CONNECTION"] = $mdb2;
@@ -136,13 +130,6 @@
        }
 
 
-       function closeConnection() {
-               if (isset($GLOBALS["_DB_CONNECTION"])) {
-                       $GLOBALS["_DB_CONNECTION"]->close();
-                       unset($GLOBALS["_DB_CONNECTION"]);
-               }
-       }
-
 // time_to_decimal converts a time string such as 1:15 to its decimal representation such as 1.25 or 1,25.
 function time_to_decimal($val) {
   global $user;
@@ -163,11 +150,9 @@ function sec_to_time_fmt_hm($sec)
 
 function magic_quotes_off()
 {
-  // if (get_magic_quotes_gpc()) { // This check is now done before calling this function.
-    $_POST = array_map('stripslashes_deep', $_POST);
-    $_GET = array_map('stripslashes_deep', $_GET);
-    $_COOKIE = array_map('stripslashes_deep', $_COOKIE);
-  // }
+  $_POST = array_map('stripslashes_deep', $_POST);
+  $_GET = array_map('stripslashes_deep', $_GET);
+  $_COOKIE = array_map('stripslashes_deep', $_COOKIE);
 }
 
 // check_extension checks whether a required PHP extension is loaded and dies if not so.
@@ -323,22 +308,42 @@ function ttValidCronSpec($val)
   return true;
 }
 
-// ttAccessCheck is used to check whether user is allowed to proceed. This function is used
-// as an initial check on all publicly available pages.
-function ttAccessCheck($required_rights)
+// ttValidCondition is used to check user input to validate a notification condition.
+function ttValidCondition($val, $emptyValid = true)
+{
+  $val = trim($val);
+  if (strlen($val) == 0)
+    return ($emptyValid ? true : false);
+
+  // String must not be XSS evil (to insert JavaScript).
+  if (stristr($val, '<script>') || stristr($val, '<script '))
+    return false;
+
+  if (!preg_match("/^count\s?>\s?\d+$/", $val))
+    return false;
+
+  return true;
+}
+
+// ttAccessAllowed checks whether user is allowed access to a particular page.
+// It is used as an initial check on all publicly available pages
+// (except login.php, register.php, and others where we don't have to check).
+function ttAccessAllowed($required_right)
 {
   global $auth;
   global $user;
-  
+
   // Redirect to login page if user is not authenticated.
   if (!$auth->isAuthenticated()) {
     header('Location: login.php');
     exit();
   }
-  
-  // Check rights.
-  if (!($required_rights & $user->rights))
-    return false;
-    
-  return true;
+
+  // Check if user has the right.
+  if (in_array($required_right, $user->rights)) {
+    ttUserHelper::updateLastAccess();
+    return true;
+  }
+
+  return false;
 }