BRA - Bug Report met Admin - Jullie mening?

Overzicht Reageren

Sponsored by: Vacatures door Monsterboard

Top Low-Code Developer Gezocht!

Bedrijfsomschrijving Unieke Kansen, Uitstekende Arbeidsvoorwaarden & Inspirerend Team Wij zijn een toonaangevende, internationale organisatie die de toekomst van technologie vormgeeft door het creëren van innovatieve en baanbrekende oplossingen. Ons succes is gebaseerd op een hecht en gepassioneerd team van professionals die altijd streven naar het overtreffen van verwachtingen. Als jij deel wilt uitmaken van een dynamische, vooruitstrevende en inspirerende werkomgeving, dan is dit de perfecte kans voor jou! Functieomschrijving Als Low-Code Developer ben je een cruciaal onderdeel van ons team. Je werkt samen met collega's uit verschillende disciplines om geavanceerde applicaties te ontwikkelen en te optimaliseren met behulp van Low-code

Bekijk vacature »

Dalando De Zuil

Dalando De Zuil

11/12/2010 09:18:23
Quote Anchor link
Code (php)
PHP script in nieuw venster Selecteer het PHP script
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
<?php
session_start();

/* Mysql query:

CREATE TABLE IF NOT EXISTS `bra` (
  `bugid` int(255) NOT NULL AUTO_INCREMENT,
  `bugtitle` mediumtext NOT NULL,
  `bugdetails` text NOT NULL,
  `status` int(255) NOT NULL,
  `ip` mediumtext NOT NULL,
  PRIMARY KEY (`bugid`)
) ENGINE=MyISAM DEFAULT CHARSET=latin1 AUTO_INCREMENT=1 ;

*/

$settings = array();

$settings['host'] = ''; // Host
$settings['user'] = ''; // User
$settings['pass'] = ''; // Wachtwoord
$settings['datb'] = ''; // Database

$settings['adminpass'] = 'adminpass'; // Admin pass

$connection = mysql_connect($settings['host'],$settings['user'],$settings['pass']);
$selectdb = mysql_select_db($settings['datb'], $connection);

if($connection){ // Wanneer geconnecteerd is
    if($selectdb){ // Wanneer database geselecteerd is
        $connected = true;
    }
    else
    {    // Wanneer niet de database is geselecteerd
        $connected = false;
        $error = 'Database wasn&#39;t selected!<br/>';
    }
}
else
{    // Wanneer niet met de database verbonden is
    $connected = false;
    $error = 'There is no connection with the database.<br/>';
}

function bugstatus($status){
    if($status == '0'){
        $return = "Not fixed";
    }
    elseif($status == '1'){
        $return = "Fixed";
    }
    elseif($status == '2'){
        $return = "Nofix";
    }
    return $return;
}

?>
<!-- Hier kan HTML geplaatst worden -->
<?php

if($connected == TRUE){
    if(isset($_GET['action'])){
        if($_GET['action'] == "add"){
            if($_SERVER['REQUEST_METHOD'] == "POST"){
                if(empty($_POST['bugtitle']) || empty($_POST['bugdetails'])){
                    echo 'One of the fields was empty! Go back and try again.<br/>';
                }
                else
                {
                    $query = "INSERT INTO bra
                              (
                                bugtitle,
                                bugdetails,
                                status,
                                ip
                              )
                              VALUES
                              (
                                '". mysql_real_escape_string($_POST['bugtitle']) ."',
                                '". mysql_real_escape_string($_POST['bugdetails']) ."',
                                '0',
                                '". $_SERVER['REMOTE_ADDR'] ."'
                              )";
                    $mysqlquery = mysql_query($query);
                    
                    if($mysqlquery){
                        echo 'Bug reported.<br/>';
                    }
                    else
                    {
                        echo 'Mysql query failed! Please contact the webmaster!<br/>';
                    }
                }
            }
            else
            {
                ?>
                <form action="bra.php?action=add" method="post">
                    Bug title: <input type="text" name="bugtitle"/><br/>
                    Details:<br/>
                    <textarea cols="50" rows="5" name="bugdetails"></textarea><br/>
                    By pressing &#39;submit&#39; you understand that you will not spam and your ip adress will be logged.<br/>
                    <input type="submit" value="submit"/>
                </form>
                <?php
            }
        }
        elseif($_GET['action'] == "admin"){
            if(isset($_SESSION['adminbra']) && $_SESSION['adminbra'] == TRUE){
                echo '<a href="bra.php?action=adminlogout">Logout</a><br/>';
                $query = "SELECT *
                          FROM bra
                          ORDER BY bugid DESC
                         ";
                $mysqlquery = mysql_query($query);
                
                if($mysqlquery){
                    if(mysql_num_rows($mysqlquery) > 0){
                        while($row = mysql_fetch_assoc($mysqlquery)){
                            echo '<a href="bra.php?action=viewbug&id='. $row['bugid'] .'">'. htmlentities($row['bugtitle']) .'</a> | status: '. bugstatus($row['status']) .' | <a href="bra.php?action=editbug&id='. $row['bugid'] .'">Edit</a> | <a href="bra.php?action=delbug&id='. $row['bugid'] .'">Delete</a> | <br/>';
                        }
                    }
                    else
                    {
                        echo 'There aren&#39;t any bugs added yet!<br/>';
                    }
                }
                else
                {
                    echo 'Mysql query failed! Contact webmaster ASAP!<br/>';
                }
                
            }
            else
            {
                echo '<a href="bra.php?action=adminlogin">Login</a> first.<br/>';
            }
        }
        elseif($_GET['action'] == "adminlogin"){
            if($_SERVER['REQUEST_METHOD'] == "POST"){
                if($_POST['password'] == $settings['adminpass']){
                    $_SESSION['adminbra'] = TRUE;
                    echo 'Logged in. Now you can visit the <a href="bra.php?action=admin">Admin</a>.<br/>';
                }
                else
                {
                    echo 'Password was incorrect! Go back and try again.<br/>';
                }
            }
            else
            {
                ?>
                <form action="bra.php?action=adminlogin" method="post">
                    password: <input type="text" name="password"/>
                    <input type="submit" value="submit"/>
                </form>
                <?php
            }
        }
        elseif($_GET['action'] == "editbug"){
            if(isset($_SESSION['adminbra']) && $_SESSION['adminbra'] == TRUE){
                if($_SERVER['REQUEST_METHOD'] == "POST"){
                    $updtqry = "UPDATE bra
                                SET
                                    bugtitle = '". mysql_real_escape_string($_POST['bugtitle']) ."',
                                    status = '". mysql_real_escape_string($_POST['bugstatus']) ."',
                                    bugdetails = '". mysql_real_escape_string($_POST['bugdetails']) ."'
                                    
                                WHERE
                                    bugid = '". $_SESSION['braupdid'] ."'
                                ";
                    if(!$res = mysql_query($updtqry))
                    {
                        echo 'Mysql error! Contact webmaster ASAP!<br/>';
                    }
                    elseif(mysql_affected_rows() == 0)
                    {
                        echo 'No updates where made!<br/>';
                    }
                    else
                    {
                        echo 'Updated.<br/>';
                    }

                }
                else
                {
                    if(isset($_GET['id']) && is_numeric($_GET['id'])){
                        $qry1 = "SELECT *
                                        FROM bra
                                        WHERE bugid = '". $_GET['id'] ."'
                                        ORDER BY bugid DESC
                                       ";
                        $mysqlqry1 = mysql_query($qry1);
                        if($mysqlqry1){
                            if(mysql_num_rows($mysqlqry1) > 0){
                                while($row1 = mysql_fetch_assoc($mysqlqry1)){
                                    $_SESSION['braupdid'] = $row1['bugid'];
                                    echo '<form action="bra.php?action=editbug" method="post">';
                                    echo 'Bug title: <input type="text" name="bugtitle" value="'. $row1['bugtitle'] .'"/><br/>';
                                    echo 'Bug status: <select name="bugstatus">';
                                    echo '<option value="0">Not fixed</option>';
                                    echo '<option value="1">Fixed</option>';
                                    echo '<option value="2">Nofix</option>';
                                    echo '</select><br/>';
                                    echo 'Details: <br/>';
                                    echo '<textarea cols="50" rows="5" name="bugdetails">'. $row1['bugdetails'] .'</textarea>';
                                    echo '<input type="submit" value="submit"/>';
                                }
                            }
                            else
                            {
                                echo 'Invalid bug id.<br/>';
                            }
                        }
                        else
                        {
                            echo 'Mysql query failed! Contact webmaster ASAP!<br/>';
                        }
                    }
                    else
                    {
                        echo 'Please provide a valid bug id.<br/>';
                    }
                }
            }
            else
            {
                echo '<a href="bra.php?action=adminlogin">Login</a> first.<br/>';
            }
        }
        elseif($_GET['action'] == "delbug"){
            if(isset($_SESSION['adminbra']) && $_SESSION['adminbra'] == TRUE){
                if(isset($_GET['id']) && is_numeric($_GET['id'])){
                    $qry1 = "SELECT *
                             FROM bra
                             WHERE bugid = '". $_GET['id'] ."'
                             ORDER BY bugid DESC
                             ";
                    $mysqlqry1 = mysql_query($qry1);
                    $mysqlnumrows1 = mysql_num_rows($mysqlqry1);
                    $result = mysql_fetch_assoc($mysqlqry1);
                    if($mysqlqry1){
                        if($mysqlnumrows1 > 0){
                                if($_SERVER['REQUEST_METHOD'] == "POST"){
                                    if($_POST['hash'] == $_SESSION['bradelhash']){
                                        $delqry = "DELETE FROM bra
                                                   WHERE bugid = ". mysql_real_escape_string($_SESSION['bradelbugid']) ."
                                                   ";
                                        if(!$res = mysql_query($delqry))
                                        {
                                            echo 'Bug is not deleted! Contact Webmaster ASAP!<br/>';
                                        }
                                        elseif(mysql_affected_rows() == 0)
                                        {
                                            echo 'No bugs where deleted. Contact Webmaster ASAP!<br/>';
                                        }
                                        else
                                        {
                                            echo 'Bug deleted!<br/>';
                                        }
                                    }
                                    else
                                    {
                                        echo 'Something went wrong with session sertification.<br/>';
                                    }
                                }
                                else
                                {
                                    $number = sha1(microtime());
                                    $_SESSION['bradelhash'] = $number;
                                    $_SESSION['bradelbugid'] = $_GET['id'];
                                    ?>
                                        
                                    Do you realy want to delete <?php echo $result['bugtitle']; ?>?<br/>
                                    <form action="bra.php?action=delbug&id=<?php echo $result['bugid']; ?>" method="post">
                                        <input type="hidden" name="hash" value="<?php echo $number; ?>"/>
                                        <input type="submit" value="Yes"/>
                                    </form>
                                    
                                    <?php
                                }
                        }
                        else
                        {
                            'Please provide a valid bug id.<br/>';
                        }
                    }
                    else
                    {
                        echo 'Mysql query failed! Contact webmaster ASAP!<br/>';
                    }
                }
                else
                {
                    echo 'Please provide a valid bug id.<br/>';
                }
            }
            else
            {
                echo '<a href="bra.php?action=adminlogin">Login</a> first.<br/>';
            }
        }
        elseif($_GET['action'] == "viewbug"){
            if(isset($_GET['id']) && is_numeric($_GET['id'])){
                $qry1 = "SELECT *
                         FROM bra
                         WHERE bugid = '". $_GET['id'] ."'
                         ORDER BY bugid DESC
                         ";
                $mysqlqry1 = mysql_query($qry1);
                
                if($mysqlqry1){
                    if(mysql_num_rows($mysqlqry1) > 0){
                        while($row1 = mysql_fetch_assoc($mysqlqry1)){
                            echo '<b>Bug title:</b> '. htmlentities($row1['bugtitle']) .'<br/>';
                            echo '<b>Bug status: </b>'. bugstatus($row1['status']) .'<br/>';
                            echo '<b>Submitted by:</b>'. $row1['ip'] .'<br/>';
                            echo '<b>Details:</b><br/>'. nl2br(htmlentities($row1['bugdetails'])) .'<br/>';
                        }
                    }
                    else
                    {
                        echo 'Invalid id.<br/>';
                    }
                }
                else
                {
                    echo 'Mysql query failed! Contact webmaster ASAP!<br/>';
                }
            }
            else
            {
                echo 'Provide a valid id.<br/>';
            }
        }
        elseif($_GET['action'] == "adminlogout"){
            if(isset($_SESSION['adminbra']) && $_SESSION['adminbra'] == TRUE){
                if($_SERVER['REQUEST_METHOD'] == "POST"){
                    if($_SESSION['bralogouthash'] == $_POST['hash']){
                        $_SESSION = array();
                        session_destroy();
                        echo 'Logged out!';
                    }
                    else
                    {
                        echo 'Something went wrong while logging out.';
                    }
                }
                else
                {
                    $number = sha1(microtime());
                    $_SESSION['bralogouthash'] = $number;
                    ?>
                    Do you realy want to log out?<br/>
                    <form action="" method="post">
                    <input type="hidden" name="hash" value="<?php echo $number; ?>"/>
                    <input type="submit" value="Yes"/>
                    </form>
                    <?php
                }
            }
            else
            {
                echo 'You aren&#39;t logged in!<br/>';
            }
        }
        else
        {
            echo '<b>All bugs</b> - <a href="bra.php?action=add">Add a bug</a><br/>';

            $qry1 = "SELECT *
                     FROM bra
                     ORDER BY bugid DESC
                    ";
            $mysqlqry1 = mysql_query($qry1);
            
            if($mysqlqry1){
                if(mysql_num_rows($mysqlqry1) > 0){
                    while($row1 = mysql_fetch_assoc($mysqlqry1)){
                        echo '<a href="bra.php?action=viewbug&id='. $row1['bugid'] .'">'. $row1['bugtitle'] .'</a> | status: '. bugstatus($row1['status']);
                    }
                }
                else
                {
                    echo 'No bugs added yet.<br/>';
                }
            }
            else
            {
                echo 'Mysql query failed! Contact webmaster ASAP!<br/>';
            }
        }                        
                        
    }
    else
    {
            echo '<b>All bugs</b> - <a href="bra.php?action=add">Add a bug</a><br/>';
            
            $qry1 = "SELECT *
                     FROM bra
                     ORDER BY bugid DESC
                    ";
            $mysqlqry1 = mysql_query($qry1);
            
            if($mysqlqry1){
                if(mysql_num_rows($mysqlqry1) > 0){
                    while($row1 = mysql_fetch_assoc($mysqlqry1)){
                        echo '<a href="bra.php?action=viewbug&id='. $row1['bugid'] .'">'. $row1['bugtitle'] .'</a> | status: '. bugstatus($row1['status']) .'<br/>';
                    }
                }
                else
                {
                    echo 'No bugs added yet.<br/>';
                }
            }
            else
            {
                echo 'Mysql query failed! Contact webmaster ASAP!<br/>';
            }
    }
}
else
{
    echo $error;
}            
                
?>
<!-- Hier kan HTML geplaatst worden -->


Nu heb ik een een Bug Report script gemaakt met Admin. Hoogtepuntje, want ik weet nu ook hoe je met UPDATE en DELETE FROM moet werken. Ik heb het gemaakt omdat ik Mantis, met z'n 12 MB, een beetje overbodig vind. Dit is slechts 12 kb. Ik wil het graag ook in de libary zetten, maar eerst nog even jullie puntjes afwachten.
Sowieso heb ik gelet op:

-XSS
-Mysql injection
-Dat logout hash injection iets (Weet de naam niet meer :x)

Zijn er nog enkele puntjes die ik kan verbeteren?
Gewijzigd op 11/12/2010 09:18:56 door Dalando De Zuil
 
PHP hulp

PHP hulp

27/11/2024 09:42:10
 
Niels K

Niels K

11/12/2010 10:24:17
Quote Anchor link
Dalando.

Laat ik eerlijk zijn, ik vind dat zeker een goede verbetering op wat je eerst schreef mijn complimenten daarvoor.

Nog een paar dingen;

- Programmeer met overzicht. Het is nu een gehele lap code. Plaats het in verschillende mappen / bestanden. Dan zul je zien dat het al gelijk overzichtelijker is.

- Het inloggen kan je ook het beste met een database doen. Nu je daar toch al mee werkt is dat natuurlijk wel zo makkelijk.

- Al die echo's in een bepaalde variabele / view gooien zodat je zelf nog betere kan bepalen waar de foutmeldingen komen te staan.

Dit was even snel wat ik zag in 2 minuten. Zal straks wel een iets uitgebreider rapport plaatsen.

Succes
 
Dalando De Zuil

Dalando De Zuil

11/12/2010 10:30:19
Quote Anchor link
Niels Kieviet op 11/12/2010 10:24:17:
Dalando.

Laat ik eerlijk zijn, ik vind dat zeker een goede verbetering op wat je eerst schreef mijn complimenten daarvoor.

Nog een paar dingen;

- Programmeer met overzicht. Het is nu een gehele lap code. Plaats het in verschillende mappen / bestanden. Dan zul je zien dat het al gelijk overzichtelijker is.

- Het inloggen kan je ook het beste met een database doen. Nu je daar toch al mee werkt is dat natuurlijk wel zo makkelijk.

- Al die echo's in een bepaalde variabele / view gooien zodat je zelf nog betere kan bepalen waar de foutmeldingen komen te staan.

Dit was even snel wat ik zag in 2 minuten. Zal straks wel een iets uitgebreider rapport plaatsen.

Succes



- Overzicht: Juist. Maar hoe zal ik dat dan gaan doen? Telkens bij een elseif de code includen ofzo?

- Zal ik gaan doen...

- Ik heb dat expres gedaan omdat je anders de meldingen boven je layout heb staan...

Ik ga even wachten op het uitgebreide rapport.
 
Jelmer -

Jelmer -

11/12/2010 11:17:27
Quote Anchor link
Overzicht kan je krijgen door je code op te splitsen in kleine blokjes: functies. Bijkomend voordeel is dat je in die kleine blokjes veel sneller foutjes kan vinden. Zo sluit je je form niet af bij je edit-bug pagina, en vergeet je htmlentities in dat formulier. En nog een ander voordeel is dat je een groot deel van je if-else kan schrappen.

Een begin daarvan:
Code (php)
PHP script in nieuw venster Selecteer het PHP script
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
<?php
session_start();

/* Mysql query:

CREATE TABLE IF NOT EXISTS `bra` (
  `bugid` int(255) NOT NULL AUTO_INCREMENT,
  `bugtitle` mediumtext NOT NULL,
  `bugdetails` text NOT NULL,
  `status` int(255) NOT NULL,
  `ip` mediumtext NOT NULL,
  PRIMARY KEY (`bugid`)
) ENGINE=MyISAM DEFAULT CHARSET=latin1 AUTO_INCREMENT=1 ;

*/

$settings = array();

$settings['host'] = ''; // Host
$settings['user'] = ''; // User
$settings['pass'] = ''; // Wachtwoord
$settings['datb'] = ''; // Database

$settings['adminpass'] = 'adminpass'; // Admin pass

$connection = mysql_connect($settings['host'],$settings['user'],$settings['pass']);
$selectdb = mysql_select_db($settings['datb'], $connection);

if($connection){ // Wanneer geconnecteerd is
    if($selectdb){ // Wanneer database geselecteerd is
        $connected = true;
    }
    else
    {    // Wanneer niet de database is geselecteerd
        $connected = false;
        $error = 'Database wasn&#39;t selected!<br/>';
    }
}
else
{    // Wanneer niet met de database verbonden is
    $connected = false;
    $error = 'There is no connection with the database.<br/>';
}

function bugstatus($status)
{
    switch ($status)
    {
        case 0:
            return 'Not fixed';
        case 1:
            return 'Fixed';
        case 2
            return 'Nofix'
        default:
            return 'Unknown';
    }
}

function esc_html($text)
{
    return htmlentities($text, ENT_QUOTES);
}

function session_log_in()
{
    $_SESSION['adminbra'] = TRUE;
}

function session_is_logged_in()
{
    return isset($_SESSION['adminbra'])
        && $_SESSION['adminbra'] == true;
}

function session_force_log_in()
{
    if (session_is_logged_in())
        return true;
        
    echo '<a href="bra.php?action=adminlogin">Login</a> first.<br/>';
    return false;
}

function db_insert_bug($title, $details, $status, $ip)
{
    $insert_query = sprintf("
        INSERT INTO bra (bugtitle, bugdetails, status, ip)
            VALUES('%s', '%s', %d, '%s')",
        mysql_real_escape_string($title),
        mysql_real_escape_string($details),
        $status,
        mysql_real_escape_string($_SERVER['REMOTE_ADDR']));
    
    if (!mysql_query($insert_query))
        return false;
    
    return mysql_insert_id();
}

function db_update_bug($bug_id, $title, $details, $status)
{
    $update_query = sprintf("
        UPDATE bra
            SET
                bugtitle = '%s',
                status = %d,
                bugdetails = '%s'
            WHERE
                bugid = %d",
        mysql_real_escape_string($title),
        mysql_real_escape_string($details),
        $status,
        $bug_id);
    
    return !!mysql_query($update_query);
}

function db_get_bug($bug_id)
{
    $select_query = sprintf("SELECT * FROM bra WHERE bugid = %d", $bug_id);
    
    $stmt = mysql_query($select_query);
    
    if (!$stmt)
        return false;
    
    // this will return false of there are no bugs found
    // so there is no need to check for it specificly
    // using mysql_num_rows :)
    return mysql_fetch_assoc($stmt);
}

function db_get_bugs()
{
    $select_query = "SELECT * FROM bra ORDER BY bugid DESC";
    
    if (!($stmt = mysql_query($query)))
        return false;
    
    $bugs = array();
    
    while ($bug = mysql_fetch_assoc($stmt))
        $bugs[] = $bug;

    return $bugs;
}

function action_post_add_bug()
{
    if (!session_force_log_in())
        return;
    
    if(empty($_POST['bugtitle']) || empty($_POST['bugdetails'])){
        echo 'One of the fields was empty! Go back and try again.<br/>';
        return;
    }
    
    if (db_insert_bug($_POST['bugtitle'], $_POST['bugdetails'], 0, $_SERVER['REMOTE_ADDR']))
        echo 'Bug reported.<br/>';
    else
        echo 'Mysql query failed! Please contact the webmaster!<br/>';
}

function action_get_add_bug()
{
    if (!session_force_log_in())
        return;
    
    ?>
    <form action="bra.php?action=add" method="post">
        Bug title: <input type="text" name="bugtitle"/><br/>
        Details:<br/>
        <textarea cols="50" rows="5" name="bugdetails"></textarea><br/>
        By pressing &#39;submit&#39; you understand that you will not spam and your ip adress will be logged.<br/>
        <input type="submit" value="submit"/>
    </form>
    <?php
}

function action_post_edit_bug()
{
    if (!session_force_log_in())
        return;
    
    if (!db_update_bug($_POST['bugtitle'], $_POST['bugstatus'],
        $_POST['bugdetails'], $_SESSION['braupdid']))
    {
        echo 'Mysql error! Contact webmaster ASAP!<br/>';
        return;
    }
    
    echo 'Updated.<br/>';
}

function action_get_edit_bug()
{    
    if (!session_force_log_in())
        return;
    
    $bug = db_get_bug($_GET['id']);
    
    if (!$bug)
    {
        echo "Bug not found (or bug id invalid or the query failed or something.
            Doesn't really matter, it won't work.)";
        return;
    }
    
    // sessies hiervoor gebruiken is wat gevaarlijk, je maakt je webapp statefull
    // (dat het wanneer je op een link drukt in een bepaalde toestand komt)
    // maar HTTP is stateless, en dit zal mis gaan wanneer je twee bugs naast
    // elkaar bewerkt. Heel erg mis zelfs.
    // Stel je zet bug A open, en daarna open je bug B in een tabblad ernaast
    // nu bewerk je bug A, en sla je die op. En tot je grote verbazing heeft hij
    // bug B overschreven!
    $_SESSION['braupdid'] = $bug['bugid'];
    
    // helper om even snel de huidige status te kunnen printen
    function _current_status($bug, $status) {
        echo $bug['status'] == $status
            ? ' selected="selected"'
            : '';
    }
    ?>
    <form action="bra.php?action=editbug" method="post">
        Bug title:
            <input type="text" name="bugtitle" value="<?php echo esc_html($row1['bugtitle'])?>" /><br/>
        Bug status:
            <select name="bugstatus">
                <option value="0" <?php _current_status($bug, 0) ?>>Not fixed</option>
                <option value="1" <?php _current_status($bug, 0) ?>>Fixed</option>
                <option value="2" <?php _current_status($bug, 0) ?>>Nofix</option>
            </select><br/>
        Details: <br/>
            <textarea cols="50" rows="5" name="bugdetails"><?php echo esc_html($row1['bugdetails']) ?></textarea>
        
        <input type="submit" value="submit"/>
    </form>
    <?php
}

function action_get_admin()
{
    if (!session_force_log_in())
        return;
    
    echo '<a href="bra.php?action=adminlogout">Logout</a><br/>';
    
    $bugs = db_get_bugs();
    
    if ($bugs ==  false)
    {
        echo 'Mysql query failed! Contact webmaster ASAP!<br/>';
        return;
    }
    
    if (count($bugs) == 0)
    {
        echo 'There aren&#39;t any bugs added yet!<br/>';
        return;
    }
    
    foreach ($bugs as $bug)
        echo '<a href="bra.php?action=viewbug&id='. $bug['bugid'] .'">'. htmlentities($bug['bugtitle']) .'</a>'
            .' | status: '. bugstatus($bug['status'])
            .' | <a href="bra.php?action=editbug&id='. $bug['bugid'] .'">Edit</a>'
            .' | <a href="bra.php?action=delbug&id='. $row['bugid'] .'">Delete</a>'
            .' | <br/>';
}

function action_post_admin_login()
{
    global $settings;
    
    if($_POST['password'] == $settings['adminpass'])
    {
        session_log_in();
        echo 'Logged in. Now you can visit the <a href="bra.php?action=admin">Admin</a>.<br/>';
    }
    else
    {
        echo 'Password was incorrect! Go back and try again.<br/>';
    }
}

function action_get_admin_login()
{
    ?>
    <form action="bra.php?action=adminlogin" method="post">
        password: <input type="text" name="password"/>
        <input type="submit" value="submit"/>
    </form>
    <?php
}

?>
<!-- Hier kan HTML geplaatst worden -->
<?php

if($connected == TRUE){
    if(isset($_GET['action'])){
        if($_GET['action'] == "add"){
            if($_SERVER['REQUEST_METHOD'] == "POST"){
                action_post_add_bug();
            }
            else
            {
                action_get_add_bug();
            }
        }
        elseif($_GET['action'] == "admin"){
            action_get_admin();
        }
        elseif($_GET['action'] == "adminlogin"){
            if($_SERVER['REQUEST_METHOD'] == "POST"){
                action_post_admin_login();
            }
            else
            {
                action_get_admin_login();
            }
        }
        elseif($_GET['action'] == "editbug"){
            if($_SERVER['REQUEST_METHOD'] == "POST"){
                action_post_edit_bug();
            } else {
                action_get_edit_bug();
            }
        }
        elseif($_GET['action'] == "delbug"){
            if(isset($_SESSION['adminbra']) && $_SESSION['adminbra'] == TRUE){
                if(isset($_GET['id']) && is_numeric($_GET['id'])){
                    $qry1 = "SELECT *
                             FROM bra
                             WHERE bugid = '". $_GET['id'] ."'
                             ORDER BY bugid DESC
                             ";
                    $mysqlqry1 = mysql_query($qry1);
                    $mysqlnumrows1 = mysql_num_rows($mysqlqry1);
                    $result = mysql_fetch_assoc($mysqlqry1);
                    if($mysqlqry1){
                        if($mysqlnumrows1 > 0){
                                if($_SERVER['REQUEST_METHOD'] == "POST"){
                                    if($_POST['hash'] == $_SESSION['bradelhash']){
                                        $delqry = "DELETE FROM bra
                                                   WHERE bugid = ". mysql_real_escape_string($_SESSION['bradelbugid']) ."
                                                   ";
                                        if(!$res = mysql_query($delqry))
                                        {
                                            echo 'Bug is not deleted! Contact Webmaster ASAP!<br/>';
                                        }
                                        elseif(mysql_affected_rows() == 0)
                                        {
                                            echo 'No bugs where deleted. Contact Webmaster ASAP!<br/>';
                                        }
                                        else
                                        {
                                            echo 'Bug deleted!<br/>';
                                        }
                                    }
                                    else
                                    {
                                        echo 'Something went wrong with session sertification.<br/>';
                                    }
                                }
                                else
                                {
                                    $number = sha1(microtime());
                                    $_SESSION['bradelhash'] = $number;
                                    $_SESSION['bradelbugid'] = $_GET['id'];
                                    ?>
                                        
                                    Do you realy want to delete <?php echo $result['bugtitle']; ?>?<br/>
                                    <form action="bra.php?action=delbug&id=<?php echo $result['bugid']; ?>" method="post">
                                        <input type="hidden" name="hash" value="<?php echo $number; ?>"/>
                                        <input type="submit" value="Yes"/>
                                    </form>
                                    
                                    <?php
                                }
                        }
                        else
                        {
                            'Please provide a valid bug id.<br/>';
                        }
                    }
                    else
                    {
                        echo 'Mysql query failed! Contact webmaster ASAP!<br/>';
                    }
                }
                else
                {
                    echo 'Please provide a valid bug id.<br/>';
                }
            }
            else
            {
                echo '<a href="bra.php?action=adminlogin">Login</a> first.<br/>';
            }
        }
        elseif($_GET['action'] == "viewbug"){
            if(isset($_GET['id']) && is_numeric($_GET['id'])){
                $qry1 = "SELECT *
                         FROM bra
                         WHERE bugid = '". $_GET['id'] ."'
                         ORDER BY bugid DESC
                         ";
                $mysqlqry1 = mysql_query($qry1);
                
                if($mysqlqry1){
                    if(mysql_num_rows($mysqlqry1) > 0){
                        while($row1 = mysql_fetch_assoc($mysqlqry1)){
                            echo '<b>Bug title:</b> '. htmlentities($row1['bugtitle']) .'<br/>';
                            echo '<b>Bug status: </b>'. bugstatus($row1['status']) .'<br/>';
                            echo '<b>Submitted by:</b>'. $row1['ip'] .'<br/>';
                            echo '<b>Details:</b><br/>'. nl2br(htmlentities($row1['bugdetails'])) .'<br/>';
                        }
                    }
                    else
                    {
                        echo 'Invalid id.<br/>';
                    }
                }
                else
                {
                    echo 'Mysql query failed! Contact webmaster ASAP!<br/>';
                }
            }
            else
            {
                echo 'Provide a valid id.<br/>';
            }
        }
        elseif($_GET['action'] == "adminlogout"){
            if(isset($_SESSION['adminbra']) && $_SESSION['adminbra'] == TRUE){
                if($_SERVER['REQUEST_METHOD'] == "POST"){
                    if($_SESSION['bralogouthash'] == $_POST['hash']){
                        $_SESSION = array();
                        session_destroy();
                        echo 'Logged out!';
                    }
                    else
                    {
                        echo 'Something went wrong while logging out.';
                    }
                }
                else
                {
                    $number = sha1(microtime());
                    $_SESSION['bralogouthash'] = $number;
                    ?>
                    Do you realy want to log out?<br/>
                    <form action="" method="post">
                    <input type="hidden" name="hash" value="<?php echo $number; ?>"/>
                    <input type="submit" value="Yes"/>
                    </form>
                    <?php
                }
            }
            else
            {
                echo 'You aren&#39;t logged in!<br/>';
            }
        }
        else
        {
            echo '<b>All bugs</b> - <a href="bra.php?action=add">Add a bug</a><br/>';

            $qry1 = "SELECT *
                     FROM bra
                     ORDER BY bugid DESC
                    ";
            $mysqlqry1 = mysql_query($qry1);
            
            if($mysqlqry1){
                if(mysql_num_rows($mysqlqry1) > 0){
                    while($row1 = mysql_fetch_assoc($mysqlqry1)){
                        echo '<a href="bra.php?action=viewbug&id='. $row1['bugid'] .'">'. $row1['bugtitle'] .'</a> | status: '. bugstatus($row1['status']);
                    }
                }
                else
                {
                    echo 'No bugs added yet.<br/>';
                }
            }
            else
            {
                echo 'Mysql query failed! Contact webmaster ASAP!<br/>';
            }
        }                        
                        
    }
    else
    {
            echo '<b>All bugs</b> - <a href="bra.php?action=add">Add a bug</a><br/>';
            
            $qry1 = "SELECT *
                     FROM bra
                     ORDER BY bugid DESC
                    ";
            $mysqlqry1 = mysql_query($qry1);
            
            if($mysqlqry1){
                if(mysql_num_rows($mysqlqry1) > 0){
                    while($row1 = mysql_fetch_assoc($mysqlqry1)){
                        echo '<a href="bra.php?action=viewbug&id='. $row1['bugid'] .'">'. $row1['bugtitle'] .'</a> | status: '. bugstatus($row1['status']) .'<br/>';
                    }
                }
                else
                {
                    echo 'No bugs added yet.<br/>';
                }
            }
            else
            {
                echo 'Mysql query failed! Contact webmaster ASAP!<br/>';
            }
    }
}
else
{
    echo $error;
}            
                
?>
<!-- Hier kan HTML geplaatst worden -->
Gewijzigd op 11/12/2010 11:18:23 door Jelmer -
 
Niels K

Niels K

11/12/2010 11:30:28
Quote Anchor link
Dan kan je ook richting OO gaan denken.
 
Jelmer -

Jelmer -

11/12/2010 11:33:49
Quote Anchor link
Niels Kieviet op 11/12/2010 11:30:28:
Dan kan je ook richting OO gaan denken.


Ja maar voordat je met OOP begint kan het geen kwaad eerst het idee te leren achter je code opbreken in kleine problemen. Daarnaast hebben objecten hier niet zoveel toegevoegde waarde. De enige objecten waar je mee werkt zijn een database vol bugs, en een bug. De rest is allemaal maar wat manipulatie van die twee.
 
Niels K

Niels K

11/12/2010 11:42:14
Quote Anchor link
Klopt. Maar daarom zei ik ook 'richting' OO. Ik denk zelf dat de TS hier nog niet klaar voor is. Omdat er aan zijn eigen code nog wat te verbeteren valt.

Maar alles opdelen is kleine parten is al een hele vooruit gang.
 
Dalando De Zuil

Dalando De Zuil

11/12/2010 16:40:59
Quote Anchor link
Jelmer, volgensmij zet je nu alleen de code in functies en zet je soms de functies neer. Dat bevordert niet echt de code...
 

11/12/2010 17:08:05
Quote Anchor link
Dalando De Zuil op 11/12/2010 16:40:59:
Jelmer, volgensmij zet je nu alleen de code in functies en zet je soms de functies neer. Dat bevordert niet echt de code...


Euh, jah? Je hebt niet altijd alle functies nodig?
 
Niek s

niek s

11/12/2010 17:33:01
Quote Anchor link
OOP wordt vaak gezien als 'met classes programmeren', en vind ik een onjuiste benaming.
Je moet gaan redeneren vanuit Objecten. Ook als je classes gebruikt kan je dat idee verkrachten, door bijvoorbeeld een erg groot systeem in 1 of 2 classes te zetten.
Voorbeeld:
enorm systeem: 'Ja ik gebruik MVC', en vervolgens zijn de enige classes de Model, View & Controller. De echte 'Objecten' ("opbreken in kleinere problemen") mist compleet.
 



Overzicht Reageren

 
 

Om de gebruiksvriendelijkheid van onze website en diensten te optimaliseren maken wij gebruik van cookies. Deze cookies gebruiken wij voor functionaliteiten, analytische gegevens en marketing doeleinden. U vindt meer informatie in onze privacy statement.