streams/include/menu.php

334 lines
8.4 KiB
PHP
Raw Normal View History

<?php /** @file */
require_once('include/security.php');
2014-02-06 00:28:51 +00:00
require_once('include/bbcode.php');
function menu_fetch($name,$uid,$observer_xchan) {
2013-08-12 02:20:05 +00:00
$sql_options = permissions_sql($uid);
$r = q("select * from menu where menu_channel_id = %d and menu_name = '%s' limit 1",
intval($uid),
dbesc($name)
);
if($r) {
$x = q("select * from menu_item where mitem_menu_id = %d and mitem_channel_id = %d
$sql_options
order by mitem_order asc, mitem_desc asc",
2013-08-12 02:20:05 +00:00
intval($r[0]['menu_id']),
intval($uid)
);
2013-08-12 02:20:05 +00:00
return array('menu' => $r[0], 'items' => $x );
}
2013-08-12 02:20:05 +00:00
return null;
}
function menu_render($menu, $class='', $edit = false) {
if(! $menu)
return '';
2014-02-05 00:06:56 +00:00
2014-02-06 00:28:51 +00:00
for($x = 0; $x < count($menu['items']); $x ++) {
2014-02-05 00:06:56 +00:00
if($menu['items'][$x]['mitem_flags'] & MENU_ITEM_ZID)
$menu['items'][$x]['mitem_link'] = zid($menu['items'][$x]['mitem_link']);
if($menu['items'][$x]['mitem_flags'] & MENU_ITEM_NEWWIN)
$menu['items'][$x]['newwin'] = '1';
2014-02-06 00:28:51 +00:00
$menu['items'][$x]['mitem_desc'] = bbcode($menu['items'][$x]['mitem_desc']);
}
return replace_macros(get_markup_template('usermenu.tpl'),array(
'$menu' => $menu['menu'],
'$class' => $class,
2014-02-18 22:26:23 +00:00
'$edit' => (($edit) ? t("Edit") : ''),
'$items' => $menu['items']
));
}
2013-08-29 03:03:01 +00:00
function menu_fetch_id($menu_id,$channel_id) {
$r = q("select * from menu where menu_id = %d and menu_channel_id = %d limit 1",
intval($menu_id),
intval($channel_id)
);
return (($r) ? $r[0] : false);
}
function menu_create($arr) {
$menu_name = trim(escape_tags($arr['menu_name']));
$menu_desc = trim(escape_tags($arr['menu_desc']));
$menu_flags = intval($arr['menu_flags']);
if(! $menu_desc)
$menu_desc = $menu_name;
if(! $menu_name)
return false;
if(! $menu_flags)
$menu_flags = 0;
$menu_channel_id = intval($arr['menu_channel_id']);
$r = q("select * from menu where menu_name = '%s' and menu_channel_id = %d limit 1",
dbesc($menu_name),
2014-02-05 00:06:56 +00:00
intval($menu_channel_id)
);
if($r)
return false;
$r = q("insert into menu ( menu_name, menu_desc, menu_flags, menu_channel_id )
values( '%s', '%s', %d, %d )",
dbesc($menu_name),
dbesc($menu_desc),
intval($menu_flags),
intval($menu_channel_id)
);
if(! $r)
return false;
$r = q("select menu_id from menu where menu_name = '%s' and menu_channel_id = %d limit 1",
dbesc($menu_name),
intval($menu_channel_id)
);
if($r)
return $r[0]['menu_id'];
return false;
}
2014-02-04 09:42:43 +00:00
/**
* If $flags is present, check that all the bits in $flags are set
* so that MENU_SYSTEM|MENU_BOOKMARK will return entries with both
* bits set. We will use this to find system generated bookmarks.
*/
2014-02-05 00:06:56 +00:00
function menu_list($channel_id, $name = '', $flags = 0) {
2014-02-05 00:06:56 +00:00
$sel_options = '';
2014-02-05 01:12:13 +00:00
$sel_options .= (($name) ? " and menu_name = '" . protect_sprintf(dbesc($name)) . "' " : '');
2014-02-05 00:06:56 +00:00
$sel_options .= (($flags) ? " and menu_flags = " . intval($flags) . " " : '');
$r = q("select * from menu where menu_channel_id = %d $sel_options order by menu_desc",
2013-08-13 08:24:02 +00:00
intval($channel_id)
);
return $r;
}
function menu_list_count($channel_id, $name = '', $flags = 0) {
2013-08-13 08:24:02 +00:00
$sel_options = '';
$sel_options .= (($name) ? " and menu_name = '" . protect_sprintf(dbesc($name)) . "' " : '');
$sel_options .= (($flags) ? " and menu_flags = " . intval($flags) . " " : '');
$r = q("select count(*) as total from menu where menu_channel_id = %d $sel_options",
intval($channel_id)
);
return $r[0]['total'];
}
function menu_edit($arr) {
$menu_id = intval($arr['menu_id']);
$menu_name = trim(escape_tags($arr['menu_name']));
$menu_desc = trim(escape_tags($arr['menu_desc']));
$menu_flags = intval($arr['menu_flags']);
if(! $menu_desc)
$menu_desc = $menu_name;
if(! $menu_name)
return false;
if(! $menu_flags)
$menu_flags = 0;
$menu_channel_id = intval($arr['menu_channel_id']);
$r = q("select menu_id from menu where menu_name = '%s' and menu_channel_id = %d limit 1",
dbesc($menu_name),
intval($menu_channel_id)
);
if(($r) && ($r[0]['menu_id'] != $menu_id)) {
logger('menu_edit: duplicate menu name for channel ' . $menu_channel_id);
return false;
}
$r = q("select * from menu where menu_id = %d and menu_channel_id = %d limit 1",
intval($menu_id),
intval($menu_channel_id)
);
if(! $r) {
logger('menu_edit: not found: ' . print_r($arr,true));
return false;
}
return q("update menu set menu_name = '%s', menu_desc = '%s', menu_flags = %d
PostgreSQL support initial commit There were 11 main types of changes: - UPDATE's and DELETE's sometimes had LIMIT 1 at the end of them. This is not only non-compliant but it would certainly not do what whoever wrote it thought it would. It is likely this mistake was just copied from Friendica. All of these instances, the LIMIT 1 was simply removed. - Bitwise operations (and even some non-zero int checks) erroneously rely on MySQL implicit integer-boolean conversion in the WHERE clauses. This is non-compliant (and bad programming practice to boot). Proper explicit boolean conversions were added. New queries should use proper conventions. - MySQL has a different operator for bitwise XOR than postgres. Rather than add yet another dba_ func, I converted them to "& ~" ("AND NOT") when turning off, and "|" ("OR") when turning on. There were no true toggles (XOR). New queries should refrain from using XOR when not necessary. - There are several fields which the schema has marked as NOT NULL, but the inserts don't specify them. The reason this works is because mysql totally ignores the constraint and adds an empty text default automatically. Again, non-compliant, obviously. In these cases a default of empty text was added. - Several statements rely on a non-standard MySQL feature (http://dev.mysql.com/doc/refman/5.5/en/group-by-handling.html). These queries can all be rewritten to be standards compliant. Interestingly enough, the newly rewritten standards compliant queries run a zillion times faster, even on MySQL. - A couple of function/operator name translations were needed (RAND/RANDOM, GROUP_CONCAT/STRING_AGG, UTC_NOW, REGEXP/~, ^/#) -- assist functions added in the dba_ - INTERVALs: postgres requires quotes around the value, mysql requires that there are not quotes around the value -- assist functions added in the dba_ - NULL_DATE's -- Postgres does not allow the invalid date '0000-00-00 00:00:00' (there is no such thing as year 0 or month 0 or day 0). We use '0001-01-01 00:00:00' for postgres. Conversions are handled in Zot/item packets automagically by quoting all dates with dbescdate(). - char(##) specifications in the schema creates fields with blank spaces that aren't trimmed in the code. MySQL apparently treats char(##) as varchar(##), again, non-compliant. Since postgres works better with text fields anyway, this ball of bugs was simply side-stepped by using 'text' datatype for all text fields in the postgres schema. varchar was used in a couple of places where it actually seemed appropriate (size constraint), but without rigorously vetting that all of the PHP code actually validates data, new bugs might come out from under the rug. - postgres doesn't store nul bytes and a few other non-printables in text fields, even when quoted. bytea fields were used when storing binary data (photo.data, attach.data). A new dbescbin() function was added to handle this transparently. - postgres does not support LIMIT #,# syntax. All databases support LIMIT # OFFSET # syntax. Statements were updated to be standard. These changes require corresponding changes in the coding standards. Please review those before adding any code going forward. Still on my TODO list: - remove quotes from non-reserved identifiers and make reserved identifiers use dba func for quoting - Rewrite search queries for better results (both MySQL and Postgres)
2014-11-13 20:21:58 +00:00
where menu_id = %d and menu_channel_id = %d",
dbesc($menu_name),
dbesc($menu_desc),
intval($menu_flags),
intval($menu_id),
intval($menu_channel_id)
);
}
function menu_delete($menu_name, $uid) {
$r = q("select menu_id from menu where menu_name = '%s' and menu_channel_id = %d limit 1",
dbesc($menu_name),
intval($uid)
);
if($r)
return menu_delete_id($r[0]['menu_id'],$uid);
return false;
}
function menu_delete_id($menu_id, $uid) {
$r = q("select menu_id from menu where menu_id = %d and menu_channel_id = %d limit 1",
intval($menu_id),
intval($uid)
);
if($r) {
$x = q("delete from menu_item where mitem_menu_id = %d and mitem_channel_id = %d",
intval($menu_id),
intval($uid)
);
return q("delete from menu where menu_id = %d and menu_channel_id = %d limit 1",
intval($menu_id),
intval($uid)
);
}
return false;
}
function menu_add_item($menu_id, $uid, $arr) {
$mitem_link = escape_tags($arr['mitem_link']);
$mitem_desc = escape_tags($arr['mitem_desc']);
$mitem_order = intval($arr['mitem_order']);
$mitem_flags = intval($arr['mitem_flags']);
2013-12-07 21:05:17 +00:00
2015-01-29 04:56:04 +00:00
if(local_channel() == $uid) {
2013-12-07 21:05:17 +00:00
$channel = get_app()->get_channel();
}
2014-02-04 09:42:43 +00:00
if (($channel)
&& (! $arr['contact_allow'])
2013-12-07 21:05:17 +00:00
&& (! $arr['group_allow'])
&& (! $arr['contact_deny'])
&& (! $arr['group_deny'])) {
$str_group_allow = $channel['channel_allow_gid'];
$str_contact_allow = $channel['channel_allow_cid'];
$str_group_deny = $channel['channel_deny_gid'];
$str_contact_deny = $channel['channel_deny_cid'];
}
else {
// use the posted permissions
$str_group_allow = perms2str($arr['group_allow']);
$str_contact_allow = perms2str($arr['contact_allow']);
$str_group_deny = perms2str($arr['group_deny']);
$str_contact_deny = perms2str($arr['contact_deny']);
}
2014-02-05 00:06:56 +00:00
// unused
// $allow_cid = perms2str($arr['allow_cid']);
// $allow_gid = perms2str($arr['allow_gid']);
// $deny_cid = perms2str($arr['deny_cid']);
// $deny_gid = perms2str($arr['deny_gid']);
$r = q("insert into menu_item ( mitem_link, mitem_desc, mitem_flags, allow_cid, allow_gid, deny_cid, deny_gid, mitem_channel_id, mitem_menu_id, mitem_order ) values ( '%s', '%s', %d, '%s', '%s', '%s', '%s', %d, %d, %d ) ",
dbesc($mitem_link),
dbesc($mitem_desc),
intval($mitem_flags),
2013-12-07 21:05:17 +00:00
dbesc($str_contact_allow),
dbesc($str_group_allow),
dbesc($str_contact_deny),
dbesc($str_group_deny),
intval($uid),
intval($menu_id),
intval($mitem_order)
);
return $r;
}
function menu_edit_item($menu_id, $uid, $arr) {
$mitem_id = intval($arr['mitem_id']);
$mitem_link = escape_tags($arr['mitem_link']);
$mitem_desc = escape_tags($arr['mitem_desc']);
$mitem_order = intval($arr['mitem_order']);
$mitem_flags = intval($arr['mitem_flags']);
2013-12-07 21:05:17 +00:00
2015-01-29 04:56:04 +00:00
if(local_channel() == $uid) {
2013-12-07 21:05:17 +00:00
$channel = get_app()->get_channel();
}
if ((! $arr['contact_allow'])
&& (! $arr['group_allow'])
&& (! $arr['contact_deny'])
&& (! $arr['group_deny'])) {
$str_group_allow = $channel['channel_allow_gid'];
$str_contact_allow = $channel['channel_allow_cid'];
$str_group_deny = $channel['channel_deny_gid'];
$str_contact_deny = $channel['channel_deny_cid'];
}
else {
// use the posted permissions
$str_group_allow = perms2str($arr['group_allow']);
$str_contact_allow = perms2str($arr['contact_allow']);
$str_group_deny = perms2str($arr['group_deny']);
$str_contact_deny = perms2str($arr['contact_deny']);
}
PostgreSQL support initial commit There were 11 main types of changes: - UPDATE's and DELETE's sometimes had LIMIT 1 at the end of them. This is not only non-compliant but it would certainly not do what whoever wrote it thought it would. It is likely this mistake was just copied from Friendica. All of these instances, the LIMIT 1 was simply removed. - Bitwise operations (and even some non-zero int checks) erroneously rely on MySQL implicit integer-boolean conversion in the WHERE clauses. This is non-compliant (and bad programming practice to boot). Proper explicit boolean conversions were added. New queries should use proper conventions. - MySQL has a different operator for bitwise XOR than postgres. Rather than add yet another dba_ func, I converted them to "& ~" ("AND NOT") when turning off, and "|" ("OR") when turning on. There were no true toggles (XOR). New queries should refrain from using XOR when not necessary. - There are several fields which the schema has marked as NOT NULL, but the inserts don't specify them. The reason this works is because mysql totally ignores the constraint and adds an empty text default automatically. Again, non-compliant, obviously. In these cases a default of empty text was added. - Several statements rely on a non-standard MySQL feature (http://dev.mysql.com/doc/refman/5.5/en/group-by-handling.html). These queries can all be rewritten to be standards compliant. Interestingly enough, the newly rewritten standards compliant queries run a zillion times faster, even on MySQL. - A couple of function/operator name translations were needed (RAND/RANDOM, GROUP_CONCAT/STRING_AGG, UTC_NOW, REGEXP/~, ^/#) -- assist functions added in the dba_ - INTERVALs: postgres requires quotes around the value, mysql requires that there are not quotes around the value -- assist functions added in the dba_ - NULL_DATE's -- Postgres does not allow the invalid date '0000-00-00 00:00:00' (there is no such thing as year 0 or month 0 or day 0). We use '0001-01-01 00:00:00' for postgres. Conversions are handled in Zot/item packets automagically by quoting all dates with dbescdate(). - char(##) specifications in the schema creates fields with blank spaces that aren't trimmed in the code. MySQL apparently treats char(##) as varchar(##), again, non-compliant. Since postgres works better with text fields anyway, this ball of bugs was simply side-stepped by using 'text' datatype for all text fields in the postgres schema. varchar was used in a couple of places where it actually seemed appropriate (size constraint), but without rigorously vetting that all of the PHP code actually validates data, new bugs might come out from under the rug. - postgres doesn't store nul bytes and a few other non-printables in text fields, even when quoted. bytea fields were used when storing binary data (photo.data, attach.data). A new dbescbin() function was added to handle this transparently. - postgres does not support LIMIT #,# syntax. All databases support LIMIT # OFFSET # syntax. Statements were updated to be standard. These changes require corresponding changes in the coding standards. Please review those before adding any code going forward. Still on my TODO list: - remove quotes from non-reserved identifiers and make reserved identifiers use dba func for quoting - Rewrite search queries for better results (both MySQL and Postgres)
2014-11-13 20:21:58 +00:00
$r = q("update menu_item set mitem_link = '%s', mitem_desc = '%s', mitem_flags = %d, allow_cid = '%s', allow_gid = '%s', deny_cid = '%s', deny_gid = '%s', mitem_order = %d where mitem_channel_id = %d and mitem_menu_id = %d and mitem_id = %d",
dbesc($mitem_link),
dbesc($mitem_desc),
intval($mitem_flags),
2013-12-07 21:05:17 +00:00
dbesc($str_contact_allow),
dbesc($str_group_allow),
dbesc($str_contact_deny),
dbesc($str_group_deny),
intval($mitem_order),
intval($uid),
intval($menu_id),
intval($mitem_id)
);
return $r;
}
function menu_del_item($menu_id,$uid,$item_id) {
PostgreSQL support initial commit There were 11 main types of changes: - UPDATE's and DELETE's sometimes had LIMIT 1 at the end of them. This is not only non-compliant but it would certainly not do what whoever wrote it thought it would. It is likely this mistake was just copied from Friendica. All of these instances, the LIMIT 1 was simply removed. - Bitwise operations (and even some non-zero int checks) erroneously rely on MySQL implicit integer-boolean conversion in the WHERE clauses. This is non-compliant (and bad programming practice to boot). Proper explicit boolean conversions were added. New queries should use proper conventions. - MySQL has a different operator for bitwise XOR than postgres. Rather than add yet another dba_ func, I converted them to "& ~" ("AND NOT") when turning off, and "|" ("OR") when turning on. There were no true toggles (XOR). New queries should refrain from using XOR when not necessary. - There are several fields which the schema has marked as NOT NULL, but the inserts don't specify them. The reason this works is because mysql totally ignores the constraint and adds an empty text default automatically. Again, non-compliant, obviously. In these cases a default of empty text was added. - Several statements rely on a non-standard MySQL feature (http://dev.mysql.com/doc/refman/5.5/en/group-by-handling.html). These queries can all be rewritten to be standards compliant. Interestingly enough, the newly rewritten standards compliant queries run a zillion times faster, even on MySQL. - A couple of function/operator name translations were needed (RAND/RANDOM, GROUP_CONCAT/STRING_AGG, UTC_NOW, REGEXP/~, ^/#) -- assist functions added in the dba_ - INTERVALs: postgres requires quotes around the value, mysql requires that there are not quotes around the value -- assist functions added in the dba_ - NULL_DATE's -- Postgres does not allow the invalid date '0000-00-00 00:00:00' (there is no such thing as year 0 or month 0 or day 0). We use '0001-01-01 00:00:00' for postgres. Conversions are handled in Zot/item packets automagically by quoting all dates with dbescdate(). - char(##) specifications in the schema creates fields with blank spaces that aren't trimmed in the code. MySQL apparently treats char(##) as varchar(##), again, non-compliant. Since postgres works better with text fields anyway, this ball of bugs was simply side-stepped by using 'text' datatype for all text fields in the postgres schema. varchar was used in a couple of places where it actually seemed appropriate (size constraint), but without rigorously vetting that all of the PHP code actually validates data, new bugs might come out from under the rug. - postgres doesn't store nul bytes and a few other non-printables in text fields, even when quoted. bytea fields were used when storing binary data (photo.data, attach.data). A new dbescbin() function was added to handle this transparently. - postgres does not support LIMIT #,# syntax. All databases support LIMIT # OFFSET # syntax. Statements were updated to be standard. These changes require corresponding changes in the coding standards. Please review those before adding any code going forward. Still on my TODO list: - remove quotes from non-reserved identifiers and make reserved identifiers use dba func for quoting - Rewrite search queries for better results (both MySQL and Postgres)
2014-11-13 20:21:58 +00:00
$r = q("delete from menu_item where mitem_menu_id = %d and mitem_channel_id = %d and mitem_id = %d",
intval($menu_id),
intval($uid),
intval($item_id)
);
return $r;
}