";
var_dump($_REQUEST);
echo " incoming array ";
var_dump($incoming);
// ******** begin database manipulation ********
// determine today's date and make it the default
$today=date("Y-m-d");
$now=date("H:i:s");
// get max report date from writeups table, validate input dates/times and set defaults
$maxrepdate_qry=mysqli_query($drs_db,"select max(report_date) from writeups");
$maxrepdate=mysqli_fetch_row($maxrepdate_qry)[0];
if (!isset($s_report_date_start) || !validateDate($s_report_date_start)) $s_report_date_start=mysqli_fetch_row(mysqli_query($drs_db,"select date_sub(curdate(),interval 30 day)"))[0];
if (!isset($s_report_date_end) || !validateDate($s_report_date_end)) $s_report_date_end=$maxrepdate;
if (!isset($s_report_time_start) || !validateTime($s_report_time_start)) $s_report_time_start="00:00:00";
if (!isset($s_report_time_end) || !validateTime($s_report_time_end)) $s_report_time_end="23:59:59";
if (!isset($edit_action_date) || !validateDate($edit_action_date)) $edit_action_date=$today;
if (!isset($edit_action_time) || !validateTime($edit_action_time)) $edit_action_time=$now;
if ($action=="add" && $role && $save) {
$fail=false;
if ($group==NULL) {
// group was not supplied, so create a new one
mysqli_query($drs_db,"insert into groups(name) value(\"\")");
$fail=mysqli_error($drs_db);
$group=mysqli_insert_id($drs_db);
}
foreach ($candidates as $candidate) {
// add writeup to the group
if (!mysqli_num_rows(mysqli_query($drs_db,"select id from links where writeupid=\"$candidate\" and linkgroup=\"$group\""))) {
// candidate is not already a member of this group
mysqli_query($drs_db,"insert into links (linkgroup,writeupid) values($group,$candidate)");
$fail=mysqli_error($drs_db);
}
}
} elseif ($action=="remove" && $role && $save) {
$fail=false;
$writeups=[];
$writeups_qry=mysqli_query($drs_db,"select writeupid from links where linkgroup=\"$group\"");
while ($writeuprow=mysqli_fetch_row($writeups_qry)) {
$writeups[]=$writeuprow[0];
}
foreach ($writeups as $writeup) {
if (!isset($candidates) || !in_array($writeup,$candidates)) {
// remove writeup from group
mysqli_query($drs_db,"delete from links where writeupid=$writeup and linkgroup=$group");
$fail=mysqli_error($drs_db);
}
}
// if there are no longer any writeups in this group, dissolve it
$memb_qty_query=mysqli_query($drs_db,"select id from links where linkgroup=\"$group\"");
if (mysqli_num_rows($memb_qty_query) == 0) {
mysqli_query($drs_db,"delete from groups where id=$group");
$fail=mysqli_error($drs_db);
}
} elseif ($action=="dissolve" && $role && $save) {
$fail=false;
// unassign all writeups from a group and delete the group
mysqli_query($drs_db,"delete from links where linkgroup=$group");
$fail=mysqli_error($drs_db);
mysqli_query($drs_db,"delete from groups where id=$group");
$fail=mysqli_error($drs_db);
} elseif ($action=="setname" && $role && $save) {
$fail=false;
// change the name of a group
// remove html tags from group name and sanitize
$name=strip_tags($name);
$clean_name=mysqli_real_escape_string($drs_db,$name);
mysqli_query($drs_db,"update groups set name=\"$clean_name\" where id=\"$group\"");
$fail=mysqli_error($drs_db);
} elseif ($action=="takeaction" && $role && $save) {
$fail=false;
// set the status, action by, reason action date/time and append supplied text to action text
// for all ids in group
if ($edit_action_reason!=NULL) {
// sanitize date and time
$edit_action_date=mysqli_real_escape_string($drs_db,$edit_action_date);
$edit_action_time=mysqli_real_escape_string($drs_db,$edit_action_time);
// remove html tags from action text and sanitize
$edit_action_text=strip_tags($edit_action_text);
$clean_edit_action_text=mysqli_real_escape_string($drs_db,$edit_action_text);
// update the group members
$groupmem_qry=mysqli_query($drs_db,"select writeupid from links where linkgroup=\"$group\"");
while ($edit_row=mysqli_fetch_row($groupmem_qry)) {
$writeup_to_edit=$edit_row[0];
$writeup_action_text=dblookup($drs_db,"writeups","id","action_text",$writeup_to_edit);
$full_action_text=$writeup_action_text." GROUP ACTION TAKEN: ".$clean_edit_action_text;
mysqli_query($drs_db,"update writeups set status=\"$edit_status\",action_by=\"$edit_action_by\",action_date=\"$edit_action_date\",action_time=\"$edit_action_time\",action_reason=\"$edit_action_reason\",action_text=\"$full_action_text\" where id=\"$writeup_to_edit\"");
$fail=mysqli_error($drs_db);
}
} else {
$fail="A status change reason was not selected.";
}
}
if ($search) {
// strip whitespace from beginning and end of text fields
$s_reported_by=trim($s_reported_by);
$s_action_text=trim($s_action_text);
$s_discrepancy_text=trim($s_discrepancy_text);
$s_id=trim($s_id);
// build the query string
$query_string="";
// device
if (isset($s_device)) {
$query_string="{$query_string}(";
$device_param="{$device_term}s:";
foreach ($s_device as $dev_val) {
$query_string="{$query_string}device=\"{$dev_val}\" or ";
$device_dsp=dblookup($drs_db,"devices","id","name",$dev_val);
$device_param="{$device_param} {$device_dsp}, ";
}
$device_param=rtrim($device_param,", ");
$num_devices=mysqli_num_rows(mysqli_query($drs_db,"select id from devices"));
if (count($s_device)==$num_devices) $device_param="{$device_term}s: any";
$query_string=rtrim($query_string," or ");
$query_string="{$query_string})";
$query_string="{$query_string} and ";
}
// subsystem
if (isset($s_subsystem)) {
$query_string="{$query_string}(";
$subsystem_param="Subsystems:";
foreach ($s_subsystem as $sub_val) {
$query_string="{$query_string}subsystem=\"{$sub_val}\" or ";
$subsystem_dsp=dblookup($drs_db,"subsystems","id","name",$sub_val);
$subsystem_param="{$subsystem_param} {$subsystem_dsp}, ";
}
$subsystem_param=rtrim($subsystem_param,", ");
$num_subsystems=mysqli_num_rows(mysqli_query($drs_db,"select id from subsystems"));
if (count($s_subsystem)==$num_subsystems) $subsystem_param="Subsystems: any";
$query_string=rtrim($query_string," or ");
$query_string="{$query_string})";
$query_string="{$query_string} and ";
}
// id
if ($s_id!=NULL) {
$query_string="{$query_string}(";
$query_string="{$query_string}id={$s_id}";
$query_string="{$query_string})";
$query_string="{$query_string} and ";
$id_param="ID: {$s_id}";
} else {
$id_param="ID: any";
}
// discovered
if (isset($s_discovered)) {
$query_string="{$query_string}(";
$discovered_param="{$discovered_term_short}s:";
foreach ($s_discovered as $disc_val) {
$query_string="{$query_string}discovered=\"{$disc_val}\" or ";
$disc_dsp=$disc_val;
$discovered_param="{$discovered_param} {$disc_dsp}, ";
}
$discovered_param=rtrim($discovered_param,", ");
$num_discovereds=mysqli_num_rows(mysqli_query($drs_db,"select id from discovered"));
if (count($s_discovered)==$num_discovereds) $discovered_param="{$discovered_term_short}s: any";
$query_string=rtrim($query_string," or ");
$query_string="{$query_string})";
$query_string="{$query_string} and ";
}
// functional
if (isset($s_functional)) {
$query_string="{$query_string}(";
$func_param="$functional_term:";
foreach ($s_functional as $func_val) {
$query_string="{$query_string}functional=\"{$func_val}\" or ";
if ($func_val=="0") $func_dsp="$functional_no_short";
if ($func_val=="1") $func_dsp="$functional_yes_short";
$func_param="{$func_param} {$func_dsp}, ";
}
$func_param=rtrim($func_param,", ");
$query_string=rtrim($query_string," or ");
$query_string="{$query_string})";
$query_string="{$query_string} and ";
}
// status
if (isset($s_status)) {
$query_string="{$query_string}(";
$status_param="Status:";
foreach ($s_status as $stat_val) {
$query_string="{$query_string}status=\"{$stat_val}\" or ";
if ($stat_val=="1") $stat_dsp="OPEN";
if ($stat_val=="2") $stat_dsp="CLSD";
if ($stat_val=="3") $stat_dsp="DFRD";
$status_param="{$status_param} {$stat_dsp}, ";
}
$status_param=rtrim($status_param,", ");
$query_string=rtrim($query_string," or ");
$query_string="{$query_string})";
$query_string="{$query_string} and ";
}
// action by
if ($s_action_by) {
$query_string="{$query_string}(";
$actionby_param="Status changed by:";
foreach ($s_action_by as $actby_val) {
$query_string="{$query_string}action_by=\"{$actby_val}\" or ";
if ($actby_val==0) {
$actionby_dsp=" (none set)";
} else {
$actionby_dsp=dblookup($drs_db,"users","id","firstname",$actby_val)." ".dblookup($drs_db,"users","id","lastname",$actby_val);
}
$actionby_param="{$actionby_param} {$actionby_dsp}, ";
}
$actionby_param=rtrim($actionby_param,", ");
$num_users=mysqli_num_rows(mysqli_query($drs_db,"select id from users"));
if (count($s_action_by)==$num_users+1) $actionby_param="Status changed by: any";
$query_string=rtrim($query_string," or ");
$query_string="{$query_string})";
$query_string="{$query_string} and ";
}
// action reason
if ($s_action_reason) {
$query_string="{$query_string}(";
$reason_param="Status change reason:";
foreach ($s_action_reason as $actrn_val) {
$query_string="{$query_string}action_reason=\"{$actrn_val}\" or ";
if ($actrn_val==0) {
$reason_dsp=" (none set)";
} else {
$reason_dsp=dblookup($drs_db,"reasons","id","text",$actrn_val);
}
$reason_param="{$reason_param} {$reason_dsp}, ";
}
$reason_param=rtrim($reason_param,", ");
$num_reasons=mysqli_num_rows(mysqli_query($drs_db,"select id from reasons"));
if (count($s_action_reason)==$num_reasons+1) $reason_param="Status change reason: any";
$query_string=rtrim($query_string," or ");
$query_string="{$query_string})";
$query_string="{$query_string} and ";
}
// report date
$query_string="{$query_string}(";
$query_string="{$query_string}report_date between \"{$s_report_date_start}\" and \"{$s_report_date_end}\"";
$query_string="{$query_string})";
$query_string="{$query_string} and ";
$reportdate_param="Report date between {$s_report_date_start} and {$s_report_date_end}";
// report time
$query_string="{$query_string}(";
$query_string="{$query_string}report_time between \"{$s_report_time_start}\" and \"{$s_report_time_end}\"";
$query_string="{$query_string})";
$query_string="{$query_string} and ";
$reporttime_param="Report time between {$s_report_time_start} and {$s_report_time_end}";
// action date
if ($s_action_date_start && $s_action_date_end) {
$query_string="{$query_string}(";
$query_string="{$query_string}action_date between \"{$s_action_date_start}\" and \"{$s_action_date_end}\"";
$query_string="{$query_string})";
$query_string="{$query_string} and ";
$actiondate_param="Action taken date between {$s_action_date_start} and {$s_action_date_end}";
} else {
$actiondate_param="Action taken date: any";
}
// action time
if ($s_action_time_start && $s_action_time_end) {
$query_string="{$query_string}(";
$query_string="{$query_string}action_time between \"{$s_action_time_start}\" and \"{$s_action_time_end}\"";
$query_string="{$query_string})";
$query_string="{$query_string} and ";
$actiontime_param="Action taken time between {$s_action_time_start} and {$s_action_time_end}";
} else {
$actiontime_param="Action taken time: any";
}
// discrepancy text
if ($s_discrepancy_text!=NULL) {
$query_string="{$query_string}(";
$query_string="{$query_string}discrepancy_text like \"%{$s_discrepancy_text}%\"";
$query_string="{$query_string})";
$query_string="{$query_string} and ";
$discrepancytext_param="Text in discrepancy: {$s_discrepancy_text}";
} else {
$discrepancytext_param="Text in discrepancy: any";
}
// action text
if ($s_action_text) {
$query_string="{$query_string}(";
$query_string="{$query_string}action_text like \"%{$s_action_text}%\"";
$query_string="{$query_string})";
$query_string="{$query_string} and ";
$actiontext_param="Text in Action taken: {$s_action_text}";
} else {
$actiontext_param="Text in Action taken: any";
}
// reported by
if ($s_reported_by!=NULL) {
$query_string="{$query_string}(";
$query_string="{$query_string}reported_by like \"%{$s_reported_by}%\"";
$query_string="{$query_string})";
$query_string="{$query_string} and ";
$repby_param="Text in Reported by: {$s_reported_by}";
} else {
$repby_param="Text in Reported by: any";
}
$query_string=rtrim($query_string," and ");
$query_string="select * from writeups where {$query_string} order by report_date asc";
// group membership
if (isset($s_group)) {
$group_param="Group member: ";
// create an array of writeups that are members of the groups specified
$group_writeups=[];
foreach ($s_group as $group_val) {
$wulink_query=mysqli_query($drs_db,"select writeupid from links where linkgroup=$group_val");
while($wulinkrow=mysqli_fetch_assoc($wulink_query)){
$group_writeups[]=$wulinkrow['writeupid'];
}
$group_name=dblookup($drs_db,"groups","id","name",$group_val);
$group_param="{$group_param} {$group_val}, ";
}
$group_param=rtrim($group_param,", ");
} else {
$group_param="Group member: any";
}
}
// ******** end database manipulation ********
pagetable("begin");
if (!$print) {
pageblock("left","begin");
sidemenu();
pageblock("left","end");
}
pageblock("right","begin");
banner($print);
echo " ";
if ($action=="add") {
if (!isset($candidates)) $candidates=[];
if (count($candidates) > 1) {
$plural="s";
} else {
$plural="";
}
if ($save && !$fail) {
format_message(0,"Writeup$plural successfully added.Return to Writeup Groups page.");
} elseif ($save && $fail) {
format_message(2,"An error was encountered when adding writeup$plural. The error was \" $fail \"");
}
if ($save) {
// show the group
$mode="view";
group_detail($group,$role,$mode);
if ($role) {
// show buttons
echo "
";
}
} else {
if ($role){
// show search form
echo "
";
// display the results ***********************************
//display the search parameters used
if ($search) {
if (!$print) echo "";
// show the parameters used block
echo "
Parameters used in this search
";
if (!$print) {
echo " Scroll up to modify parameters
";
} else {
echo "";
}
echo "
$status_param
$device_param
$subsystem_param
$id_param
$discovered_param
$reportdate_param
$reporttime_param
$discrepancytext_param
$repby_param
$func_param
$group_param
$actionby_param
$reason_param
$actiontext_param
$actiondate_param
$actiontime_param
";
// show the results
$currentparams=arrayCopy($_REQUEST);
echo "
";
} else {
echo "
No writeups match your search parameters.
You can modify the search parameters above and search again or select another menu option.
";
}
}
}
}
} elseif ($action=="remove") {
if ($save && !$fail) {
format_message(0,"Group successfully modified.Return to Writeup Groups page.");
} elseif ($save && $fail) {
format_message(2,"An error was encountered when modifying group. The error was \" $fail \"");
}
if ($role && mysqli_num_rows(mysqli_query($drs_db,"select id from links where linkgroup=$group"))) {
// show group table with everything selected
echo "
";
}
} elseif ($action=="dissolve") {
if ($save && !$fail) {
format_message(0,"Group dissolved.Return to Writeup Groups page.");
} elseif ($save && $fail) {
format_message(2,"An error was encountered when dissolving the group. The error was \" $fail \"");
} else {
if ($role) {
echo "
";
}
// show the group
$mode="view";
group_detail($group,$role,$mode);
if ($role) {
// show buttons
echo "
";
}
}
} elseif ($action=="setname") {
if ($save && !$fail) {
format_message(0,"Group name updated.Return to Writeup Groups page.");
} elseif ($save && $fail) {
format_message(2,"An error was encountered when updating the group name. The error was \" $fail \"");
}
if ($role) {
// get current group name if there is one and show the form
$curr_name=dblookup($drs_db,"groups","id","name",$group);
echo "
";
}
// show the group
$mode="view";
group_detail($group,$role,$mode);
if ($role) {
// show buttons
echo "
";
}
} elseif ($action=="takeaction") {
if ($save && !$fail) {
format_message(0,"Group action completed.Return to Writeup Groups page.");
} elseif ($save && $fail) {
format_message(2,"An error was encountered when taking group action. The error was \" $fail \"");
}
// show the group
$mode="view";
group_detail($group,$role,$mode);
if ($role && ! $save) {
// show action form
echo "
";
}
} else {
if ($role) {
echo "
";
}
if ($group!=NULL) {
// show only the requested group
$mode="view";
group_detail($group,$role,$mode);
if ($role) {
// show buttons
echo "
";
}
echo " ";
} else {
// show group table
$groups_qry=mysqli_query($drs_db,"select * from groups");
if (mysqli_num_rows($groups_qry)) {
echo "
ID
Name
Writeups assigned
";
while ($grouprow=mysqli_fetch_assoc($groups_qry)) {
$num_query=mysqli_query($drs_db,"select id from links where linkgroup={$grouprow['id']}");
$num_writeups=mysqli_num_rows($num_query);
if($grouprow['name']=="") {
$name_text="Group {$grouprow['id']} has not been named";
} else {
$name_text="{$grouprow['name']}";
}
// print table row
printf(
"