Added team_id to project delete and update queries to reduce risk of misuse.

[timetracker.git] / WEB-INF / lib / ttProjectHelper.class.php

diff --git a/WEB-INF/lib/ttProjectHelper.class.php b/WEB-INF/lib/ttProjectHelper.class.php
index 1ec21fe..d3e0eb1 100644 (file)
--- a/WEB-INF/lib/ttProjectHelper.class.php
+++ b/WEB-INF/lib/ttProjectHelper.class.php
@@ -67,6 +67,7 @@ class ttProjectHelper {
     $res = $mdb2->query($sql);
     if (!is_a($res, 'PEAR_Error')) {
       while ($val = $res->fetchRow()) {
+        $val['rate'] = str_replace('.', $user->decimal_mark, $val['rate']);
         $result[] = $val;
       }
     }
@@ -76,9 +77,9 @@ class ttProjectHelper {
   // getProjects - returns an array of active and inactive projects in a team.
   static function getProjects()
   {
-       global $user;
-               
-       $result = array();
+    global $user;
+
+    $result = array();
     $mdb2 = getConnection();
     
     $sql = "select id, name, tasks from tt_projects
@@ -153,33 +154,31 @@ class ttProjectHelper {
   
   // delete - deletes things associated with a project and marks the project as deleted. 
   static function delete($id) {
+    global $user;
     $mdb2 = getConnection();
-    
+
+    // Start with project itself. Reason: if the passed in project_id is bogus,
+    // we'll fail right here and don't damage any other data.
+
+    // Mark project as deleted and remove associated tasks.
+    $sql = "update tt_projects set status = NULL, tasks = NULL where id = $id and team_id = $user->team_id";
+    $affected = $mdb2->exec($sql);
+    if (is_a($affected, 'PEAR_Error') || 0 == $affected)
+      return false; // An error ocurred, or 0 rows updated.
+
     // Delete user binds to this project.
     $sql = "delete from tt_user_project_binds where project_id = $id";
     $affected = $mdb2->exec($sql);
-    if (is_a($affected, 'PEAR_Error'))
-      return false;
-    
-       // Delete task binds to this project.
-    $sql = "delete from tt_project_task_binds where project_id = $id";
-    $affected = $mdb2->exec($sql);
-    if (is_a($affected, 'PEAR_Error'))
-      return false;
-    
-    // Remove associated tasks.
-    $sql = "update tt_projects set tasks = NULL where id = $id";
-    $affected = $mdb2->exec($sql);
     if (is_a($affected, 'PEAR_Error'))
       return false;
 
-    // Mark project as deleted.
-    $sql = "update tt_projects set status = NULL where id = $id";
+    // Delete task binds to this project.
+    $sql = "delete from tt_project_task_binds where project_id = $id";
     $affected = $mdb2->exec($sql);
     if (is_a($affected, 'PEAR_Error'))
       return false;
 
-       return true;
+    return true;
   }
   
   // insert function inserts a new project into database.
@@ -235,8 +234,8 @@ class ttProjectHelper {
   } 
 
   // update function - updates the project in database.
-  static function update($fields)
-  {
+  static function update($fields) {
+    global $user;
     $mdb2 = getConnection();
     
     $project_id = $fields['id']; // Project we are updating.
@@ -255,9 +254,9 @@ class ttProjectHelper {
       if(!in_array($row['user_id'], $users_to_bind)) { 
        // Delete tt_user_project_binds record (safely).
        ttUserHelper::deleteBind($row['user_id'], $project_id);
-      } else if (!$row['status']) {
+      } elseif (!$row['status']) {
        // If we are here, status of the bind is not active. Memorize such users to update their bind status.
-               $users_to_update[] = $row['user_id'];  // Users we need to update in tt_user_project_binds.
+        $users_to_update[] = $row['user_id'];  // Users we need to update in tt_user_project_binds.
       }
       $all_users[] = $row['user_id']; // All users from tt_user_project_binds for project.
     }
@@ -312,7 +311,8 @@ class ttProjectHelper {
     
     // Update project name, description, tasks and status in tt_projects table.
     $comma_separated = implode(",", $tasks_to_bind); // This is a comma-separated list of associated task ids.
-    $sql = "update tt_projects set name = ".$mdb2->quote($name).", description = ".$mdb2->quote($description).", tasks = ".$mdb2->quote($comma_separated).", status = $status where id = $project_id";
+    $sql = "update tt_projects set name = ".$mdb2->quote($name).", description = ".$mdb2->quote($description).
+           ", tasks = ".$mdb2->quote($comma_separated).", status = $status where id = $project_id and team_id = $user->team_id";
     $affected = $mdb2->exec($sql);
     return (!is_a($affected, 'PEAR_Error'));
   }
@@ -338,4 +338,3 @@ class ttProjectHelper {
     return $result;
   }*/
 }
-?>
\ No newline at end of file