Files
OpenDRS/distfiles/writeupdetail.php

649 lines
20 KiB
PHP

<?php
/*
writeupdetail.php
OpenDRS Online Discrepancy Reporting System
Copyright (C) 2025 Rod Wright
SPDX-License-Identifier: GPL-2.0
*/
include("common.php");
if (array_key_exists('print',$_REQUEST)) {
$print=true;
} else {
$print=false;
}
// redirect to login page if access_mode is untrusted and user is
// not logged in
if ($access_mode == "untrusted" && ! isset($_SESSION['userid'])) {
header("Cache-Control:no-cache, must-revalidate");
header("Pragma:no-cache");
header("Location:login.php");
exit();
}
// redirect to writeups.php on change cancel
if (array_key_exists('cancel',$_REQUEST)) {
$id=$_REQUEST['id'];
header("Cache-Control:no-cache, must-revalidate");
header("Pragma:no-cache");
header("Location:writeupdetail.php?id=$id");
exit();
}
// import session variables
if (isset($_SESSION['userid'])) $userid=$_SESSION['userid'];
// import incoming arrays
if ($print) {
// if printer friendly was clicked, values will be passed in serialized
// form as "all_parameters" so we need to load those into $incoming[]
$incoming=unserialize($_REQUEST['all_parameters']);
} else {
// copy $_REQUEST[] to $incoming[]
$incoming=arrayCopy($_REQUEST);
}
// extract incoming array keys into variables
extract($incoming, EXTR_SKIP);
/*
* possible keys are:
* usersave
* techsave
* useredit
* techedit
* id
* device
* discovered
* functional
* reported_by
* report_date
* report_time
* subsystem
* discrepancy_text
* status
* action_by
* action_date
* action_time
* action_reason
* action_text
* group
*/
if (!isset($usersave)) $usersave=false;
if (!isset($techsave)) $techsave=false;
if (!isset($useredit)) $useredit=false;
if (!isset($techedit)) $techedit=false;
if (!isset($group)) $group=[];
// assign variables from constants
$appname=APP_NAME;
if ($print) {
$mbgcolor=P_MENUBG_COLOR;
} else {
$mbgcolor=MENUBG_COLOR;
}
$role=dblookup($drs_db,"users","id","role",$userid);
framework("begin","$appname","Writeup Detail",$print);
//echo "_REQUEST array <br>";
//var_dump($_REQUEST);
//echo "<br><hr> incoming array <br>";
//var_dump($incoming);
// ******** begin database manipulation ********
if ($usersave) {
// user parameters
if ($discrepancy_text && $reported_by) {
// sanitize and fix blank date and time
$report_date=mysqli_real_escape_string($drs_db,$report_date);
$report_time=mysqli_real_escape_string($drs_db,$report_time);
if (!$report_date) $report_date=$today;
if (!$report_time) $report_time=$now;
// remove html tags from discrepancy text and sanitize
$discrepancy_text=strip_tags($discrepancy_text);
$clean_discrepancy_text=mysqli_real_escape_string($drs_db,$discrepancy_text);
$clean_reported_by=mysqli_real_escape_string($drs_db,$reported_by);
// update the record in writeups
mysqli_query($drs_db,"update writeups set device=\"$device\",discovered=\"$discovered\",functional=\"$functional\",reported_by=\"$clean_reported_by\",report_date=\"$report_date\",report_time=\"$report_time\",subsystem=\"$subsystem\",discrepancy_text=\"$clean_discrepancy_text\" where id=\"$id\"");
// remove writeup from all groups and add to only selected groups
mysqli_query($drs_db,"delete from links where writeupid=\"$id\"");
foreach($group as &$link) {
if($link==0) {
// new group was requested
mysqli_query($drs_db,"insert into groups(name) value(\"\")");
$newgroup=mysqli_insert_id($drs_db);
$link=$newgroup;
}
mysqli_query($drs_db,"insert into links(linkgroup, writeupid) values(\"$link\", \"$id\")");
}
}
}
elseif ($techsave) {
// tech parameters
if ($role) {
if ($action_text) {
// sanitize and fix blank date and time
$action_date=mysqli_real_escape_string($drs_db,$action_date);
$action_time=mysqli_real_escape_string($drs_db,$action_time);
if (!$action_date) $action_date=$today;
if (!$action_time) $action_time=$now;
// remove html tags from action text and sanitize
$action_text=strip_tags($action_text);
$clean_action_text=mysqli_real_escape_string($drs_db,$action_text);
// update the record in writeups
if ($action_reason=='') $action_reason=0;
mysqli_query($drs_db,"update writeups set status=\"$status\",action_by=\"$action_by\",action_date=\"$action_date\",action_time=\"$action_time\",action_reason=\"$action_reason\",action_text=\"$clean_action_text\" where id=\"$id\"");
}
}
}
// get current writeup data from database to populate fields
$writeupdata=mysqli_fetch_assoc(mysqli_query($drs_db,"select * from writeups where id=\"$id\""));
$device=$writeupdata['device'];
$discovered=$writeupdata['discovered'];
$functional=$writeupdata['functional'];
$reported_by=$writeupdata['reported_by'];
$report_date=$writeupdata['report_date'];
$report_time=$writeupdata['report_time'];
$subsystem=$writeupdata['subsystem'];
$discrepancy_text=$writeupdata['discrepancy_text'];
$status=$writeupdata['status'];
$action_by=$writeupdata['action_by'];
$action_date=$writeupdata['action_date'];
$action_time=$writeupdata['action_time'];
$action_reason=$writeupdata['action_reason'];
$action_text=$writeupdata['action_text'];
if ($useredit || $techedit) {
if (!$report_date) $report_date=$today;
if (!$report_time) $report_time=$now;
} else {
if (!$report_date) $report_date="&nbsp;";
if (!$report_time) $report_time="&nbsp;";
}
if ($techedit) {
if (!$action_date) $action_date=$today;
if (!$action_time) $action_time=$now;
} else {
if (!$action_date) $action_date="&nbsp;";
if (!$action_time) $action_time="&nbsp;";
}
// ******** end database manipulation ********
pagetable("begin");
if (!$print) {
pageblock("left","begin");
sidemenu();
pageblock("left","end");
}
pageblock("right","begin");
banner($print);
echo "<br>";
// display the form
if ($usersave) {
if ($discrepancy_text && $reported_by) {
format_message(0,"<strong>Writeup modified.</strong> <a href=\"writeups.php\">Return to Open Writeups page.</a>");
}
if (!$discrepancy_text) {
format_message(1,"You didn't enter any discrepancy text. Please try again.");
}
if (!$reported_by) {
format_message(1,"You didn't enter your name in the Reported by: block. Please try again.");
}
}
if ($techsave) {
if ($role && $action_text) {
format_message(0,"<strong>Writeup modified.</strong> <a href=\"writeups.php\">Return to Open Writeups page.</a>");
}
if ($role && !$action_text) {
format_message(1,"You didn't enter any action taken text. Please try again.");
}
}
echo "
<form method=\"post\" action=\"writeupdetail.php\">
<input type=\"hidden\" name=\"id\" value=\"$id\">
";
// start writeup table section
if ($status==1) $statusind="<b><font color=\"#FF0000\">OPEN</font></b>";
if ($status==2) $statusind="<b><font color=\"#00FF00\">CLSD</font></b>";
if ($status==3) $statusind="<b><font color=\"#FFFF00\">DFRD</font></b>";
echo "
<table border=\"0\" cellpadding=\"5\" width=\"600\">
<tr>
<td align=\"left\">Writeup ID<br>
<table border=\"1\" width=\"100%\"><tr><td><center>$id</center></td></tr></table>
</td>
<td align=\"left\">$device_term<br>
";
if ($useredit) {
echo "
<select name=\"device\" id=\"device\">
";
$drow=mysqli_query($drs_db,"select * from devices where active is true order by id asc");
while ($ditem=mysqli_fetch_assoc($drow)) {
if ($device==$ditem["id"]) {
printf("<option value=\"%s\" selected>%s</option>",$ditem["id"],$ditem["name"]);
} else {
printf("<option value=\"%s\">%s</option>",$ditem["id"],$ditem["name"]);
}
}
echo "
</select>
";
} else {
$dname=dblookup($drs_db,"devices","id","name",$device);
echo "
<table border=\"1\" width=\"100%\"><tr><td>$dname</td></tr></table>
";
}
echo "
</td>
<td align=\"left\">Subsystem<br>
";
if ($useredit) {
echo "
<select name=\"subsystem\" id=\"subsystem\">
";
$ssrow=mysqli_query($drs_db,"select * from subsystems where active is true order by id asc");
while ($ssitem=mysqli_fetch_assoc($ssrow)) {
if ($subsystem==$ssitem["id"]) {
printf("<option value=\"%s\" title=\"%s\" selected>%s</option>",$ssitem["id"],$ssitem["description"],$ssitem["name"]);
} else {
printf("<option value=\"%s\" title=\"%s\">%s</option>",$ssitem["id"],$ssitem["description"],$ssitem["name"]);
}
}
echo "
</select>
";
} else {
$ssname=dblookup($drs_db,"subsystems","id","name",$subsystem);
$ssdesc=dblookup($drs_db,"subsystems","id","description",$subsystem);
echo "
<table border=\"1\" width=\"100%\"><tr><td><font title=\"$ssdesc\">$ssname</font></td></tr></table>
";
}
echo "
</td>
</tr>
<tr>
<td align=\"left\">$discovered_term<br>
";
if ($useredit) {
echo "
<select name=\"discovered\" id=\"discoveredselect\">
";
if ($disc_drop_data=="Name") {
$discddtitle="whendiscovereddesc";
$discddtext="whendiscoveredname";
} else if ($disc_drop_data=="Desc") {
$discddtitle="whendiscoveredname";
$discddtext="whendiscovereddesc";
}
$discrow=mysqli_query($drs_db,"select * from discovered where active is true order by whendiscoveredname asc");
while ($discitem=mysqli_fetch_assoc($discrow)) {
if ($discovered==$discitem["id"]) {
printf("<option value=\"%s\" title=\"%s\" selected>%s</option>",$discitem["id"],$discitem["$discddtitle"],$discitem["$discddtext"]);
} else {
printf("<option value=\"%s\" title=\"%s\">%s</option>",$discitem["id"],$discitem["$discddtitle"],$discitem["$discddtext"]);
}
}
echo "
</select>
";
} else {
$discname=dblookup($drs_db,"discovered","id","whendiscoveredname",$discovered);
$discdesc=dblookup($drs_db,"discovered","id","whendiscovereddesc",$discovered);
echo "
<table border=\"1\" width=\"100%\"><tr><td><font title=\"$discdesc\">$discname</font></td></tr></table>
";
}
echo "
</td>
";
$funcyesstate=$funcnostate="";
if($functional==1) {
$funcyesstate="checked";
$func_ind="$functional_yes";
}
if($functional==0) {
$funcnostate="checked";
$func_ind="$functional_no";
}
$openstate=$closedstate=$deferredstate="";
if($status==1) $openstate="selected";
if($status==2) $closedstate="selected";
if($status==3) $deferredstate="selected";
echo "
<td align=\"left\" >Report Date<br>
";
if ($useredit && $role) {
echo "
<input type=\"text\" name=\"report_date\" size=\"10\" maxlength=\"10\" value=\"$report_date\" id=\"reportdatepicker\" title=\"Format: YYYY-MM-DD\"></td>
";
} else {
echo "
<table border=\"1\" width=\"100%\"><tr><td>$report_date</td></tr></table></td>
";
}
echo "
<td align=\"left\">Report Time<br>
";
if ($useredit && $role) {
echo "
<input type=\"text\" name=\"report_time\" size=\"8\" maxlength=\"8\" value=\"$report_time\" title=\"Format: HH:MM:SS\"></td>
";
} else {
echo "
<table border=\"1\" width=\"100%\"><tr><td>$report_time</td></tr></table></td>
";
}
echo "
</tr>
<tr><td></td><td></td><td></td></tr>
<tr><td colspan=\"3\">
Discrepancy <font size=\"-2\">(required)</font><br>
";
if ($useredit) {
echo "<textarea rows=\"10\" cols=\"80\" name=\"discrepancy_text\" wrap=\"soft\">$discrepancy_text</textarea><br>";
} else {
echo "<table border=\"1\" width=\"100%\"><tr><td>$discrepancy_text</td></tr></table><br>";
}
echo "
</tr>
<tr>
<td>Reported by <font size=\"-2\">(required)</font><br>
";
if ($useredit) {
echo "
<input type=\"text\" name=\"reported_by\" size=\"30\" value=\"$reported_by\" title=\"Who to contact for questions about this writeup\"></td>
";
} else {
echo "
<table border=\"1\" width=\"100%\"><tr><td>$reported_by</td></tr></table></td>
";
}
echo "
<td align=\"left\">$functional_term? &nbsp; <img src=\"icons/question.png\" title=\"" . FUNCTIONAL_HELP_TXT . "\"><br>
";
if ($useredit) {
echo "
<input type=\"radio\" name=\"functional\" value=\"1\" $funcyesstate> Yes &nbsp;&nbsp;&nbsp;&nbsp;
<input type=\"radio\" name=\"functional\" value=\"0\" $funcnostate> No
";
} else {
echo "
<table border=\"1\" width=\"100%\"><tr><td><font title=\"" . FUNCTIONAL_HELP_TXT . "\">$func_ind</font></td></tr></table>
";
}
echo "
</td>
";
if ($useredit) {
echo "
<td align=\"right\" valign=\"bottom\"><input type=\"submit\" name=\"usersave\" value=\"Save Changes\"></td>
</tr>
<tr>
<td colspan=\"2\">Group Assignments:&nbsp;&nbsp
";
// Group multi-select ********************
echo "
<select style=\"max-width:60%;\" name=\"group[]\" id=\"ms-group\" multiple title=\"Select the groups this writeup should be a member of.\">
";
$linkquery=mysqli_query($drs_db,"select * from links where writeupid=\"$id\"");
// create an array of ids returned by group query
$wugroups=[];
while ($eachlink=mysqli_fetch_assoc($linkquery)) {
$wugroups[]=$eachlink['linkgroup'];
}
reset($wugroups);
$grow=mysqli_query($drs_db,"select * from groups order by id asc");
printf("<option value=\"%s\">%s</option>",0,"New group");
while ($gitem=mysqli_fetch_assoc($grow)) {
if ($gitem["name"]=="") {
$gname="Group ".$gitem["id"];
} else {
$gname=$gitem["name"];
}
if (in_array($gitem["id"],$wugroups,true)) {
printf("<option value=\"%s\" selected>%s</option>",$gitem["id"],$gname);
} else {
printf("<option value=\"%s\">%s</option>",$gitem["id"],$gname);
}
}
echo "
</select>
";
echo "
</td>
<td align=\"right\" valign=\"bottom\">
<input type=\"submit\" name=\"cancel\" value=\"Cancel Changes\"></td>
</tr>
";
} else {
echo "<tr></tr><td colspan=\"2\">Group Assignments:&nbsp;&nbsp";
$wustat=dblookup($drs_db,"writeups","id","status",$id);
if ($wustat==2 && !$role) {
$allowuseredit="disabled";
} else {
$allowuseredit=NULL;
}
// Group multi-select ********************
echo "
<select style=\"max-width:60%;\" name=\"groupshow\" id=\"ms-group\" multiple title=\"The groups this writeup is a member of.\">
";
$linkquery=mysqli_query($drs_db,"select * from links where writeupid=\"$id\"");
// create an array of ids returned by group query
$wugroups=[];
while ($eachlink=mysqli_fetch_assoc($linkquery)) {
$wugroups[]=$eachlink['linkgroup'];
}
reset($wugroups);
$grow=mysqli_query($drs_db,"select * from groups order by id asc");
while ($gitem=mysqli_fetch_assoc($grow)) {
if ($gitem["name"]=="") {
$gname="Group ".$gitem["id"];
} else {
$gname=$gitem["name"];
}
if (in_array($gitem["id"],$wugroups,true)) {
printf("<option value=\"%s\" selected disabled>%s</option>",$gitem["id"],$gname);
}
}
echo "
</select>
</td>
";
echo "
<td align=\"right\" valign=\"bottom\"><input $allowuseredit type=\"submit\" name=\"useredit\" value=\"Edit this Discrepancy\"></td>
</tr>
";
}
// end of user section
echo "
<tr><td colspan=\"3\" bgcolor=\"black\"></td></tr>
<tr><td colspan=\"3\" bgcolor=\"black\"></td></tr>
<tr>
<td>Status<br>
";
if ($techedit) {
echo "
<select name=\"status\" id=\"status\">
<option value=\"1\" $openstate>OPEN</option>
<option value=\"2\" $closedstate>CLOSED</option>
<option value=\"3\" $deferredstate>DEFERRED</option>
</select>
";
} else {
echo "
<table border=\"1\" width=\"100%\"><tr><td><center>$statusind</center></td></tr></table>
";
}
echo "
</td>
<td>Action taken by<br>
";
if ($techedit) {
if ($role==ADMIN) {
// allow selection of tech name
echo "
<select name=\"action_by\" id=\"user\">
";
$persrow=mysqli_query($drs_db,"select id,firstname,lastname from users where active is true order by lastname asc");
while ($persitem=mysqli_fetch_assoc($persrow)) {
if ($userid==$persitem["id"]) {
printf("<option value=\"%s\" selected>%s %s</option>",$persitem["id"],$persitem["firstname"],$persitem["lastname"]);
} else {
printf("<option value=\"%s\">%s %s</option>",$persitem["id"],$persitem["firstname"],$persitem["lastname"]);
}
}
echo "
</select>
";
} else {
// limit the choice to the tech in question
echo "
<select name=\"action_by\" id=\"user\">
";
$persrow=mysqli_query($drs_db,"select id,firstname,lastname from users where active is true order by lastname asc");
while ($persitem=mysqli_fetch_assoc($persrow)) {
if ($userid==$persitem["id"]) {
printf("<option value=\"%s\" selected>%s %s</option>",$persitem["id"],$persitem["firstname"],$persitem["lastname"]);
}
}
echo "
</select>
";
}
} else {
$techfname=dblookup($drs_db,"users","id","firstname",$action_by);
$techlname=dblookup($drs_db,"users","id","lastname",$action_by);
echo "
<table border=\"1\" width=\"100%\"><tr><td>$techfname $techlname&nbsp;</td></tr></table>
";
}
echo "
</td>
<td>Status change reason<br>
";
if ($techedit) {
echo "
<select name=\"action_reason\" id=\"reason\">
";
$reasrow=mysqli_query($drs_db,"select id,text from reasons where active is true order by id asc");
if (!$action_reason) echo "<option selected></option>";
while ($reasitem=mysqli_fetch_assoc($reasrow)) {
if ($action_reason==$reasitem["id"]) {
printf("<option value=\"%s\" selected>%s</option>",$reasitem["id"],$reasitem["text"]);
} else {
printf("<option value=\"%s\">%s</option>",$reasitem["id"],$reasitem["text"]);
}
}
echo "
</select>
";
} else {
$reasonname=dblookup($drs_db,"reasons","id","text",$action_reason);
echo"
<table border=\"1\" width=\"100%\"><tr><td>$reasonname&nbsp;</td></tr></table>
";
}
echo "
</td>
</tr>
<tr><td></td><td></td><td></td></tr>
<tr><td colspan=\"3\">
Action Taken <font size=\"-2\">(required)</font><br>
";
if ($techedit) {
echo "
<textarea rows=\"10\" cols=\"80\" name=\"action_text\" wrap=\"soft\">$action_text</textarea><br>
";
} else {
echo "
<table border=\"1\" width=\"100%\"><tr><td>$action_text&nbsp;</td></tr></table>
";
}
echo "
</td>
</tr>
<tr>
<td align=\"left\" >Action Taken Date<br>
";
if ($techedit) {
echo "
<input type=\"text\" name=\"action_date\" size=\"10\" maxlength=\"10\" value=\"$action_date\" id=\"actiondatepicker\" title=\"Format: YYYY-MM-DD\"></td>
";
} else {
echo "
<table border=\"1\" width=\"100%\"><tr><td>$action_date</td></tr></table></td>
";
}
echo "
<td align=\"left\">Action Taken Time<br>
";
if ($techedit) {
echo "
<input type=\"text\" name=\"action_time\" size=\"8\" maxlength=\"8\" value=\"$action_time\" title=\"Format: HH:MM:SS\"></td>
";
} else {
echo "
<table border=\"1\" width=\"100%\"><tr><td>$action_time</td></tr></table></td>
";
}
if ($techedit) {
echo "
<td align=\"right\" valign=\"bottom\"><input type=\"submit\" name=\"techsave\" value=\"Save Changes\"></td>
</tr>
<tr>
<td></td><td></td>
<td align=\"right\" valign=\"bottom\">
<input type=\"submit\" name=\"cancel\" value=\"Cancel Changes\"></td>
</tr>
";
} else {
if (!$role) {
$live="disabled";
} else {
$live=NULL;
}
echo "
<td align=\"right\" valign=\"bottom\"><input $live type=\"submit\" name=\"techedit\" value=\"Edit this Action\"></td>
</tr>
";
}
echo "
</table>
</form>
<br>
";
banner($print);
pageblock("right","end");
pagetable("end");
framework("end","","",$print);
?>