determine original owner of template to prevent stealing it when the intent is to copy it

CHANGELOG

@@ -278,3 +278,6 @@
         installation.
     - Various code cleanups to prevent php warnings in the logs if logging
         is enabled.
+    - Validate all date and time fields to prevent user entered invalid date
+        formats from crashing php.
+    

database-initial.sql

@@ -122,7 +122,7 @@ set autocommit = 0;
 
 INSERT INTO
     `configs`
-VALUES (1, 'ol_version', '5.2.4'),
+VALUES (1, 'ol_version', '5.3.0'),
     (2, 'log_name', 'OpenLog'),
     (3, 'banner', '1'),
     (

default-apache.conf

@@ -0,0 +1,13 @@
+# _APPNAME_ default Apache configuration
+
+Alias /_BASEURL_ _DOCROOTIN_/_BASEURL_
+
+<Directory _DOCROOTIN_/_BASEURL_>
+    AllowOverride Options
+    Options FollowSymLinks
+    DirectoryIndex index.php
+
+    #RewriteEngine On
+    #RewriteBase /_BASEURL_/
+    #RewriteRule . maintenancemode.php [L]
+</Directory>

distfiles/CHANGELOG

@@ -278,3 +278,6 @@
         installation.
     - Various code cleanups to prevent php warnings in the logs if logging
         is enabled.
+    - Validate all date and time fields to prevent user entered invalid date
+        formats from crashing php.
+    

distfiles/functions.php

@@ -953,8 +953,9 @@ function templateselect($techid, $operation)
 {
     // Displays a line enabling selection of a user or global template
     // $techid is the id number of the current tech
-    // $operation is one of "add" "edit" "delete"
+    // $operation is one of "add" "edit" "delete" or NULL
     global $db;
+    $isadmin = dblookup($db, "techs", "techid", "admin", $techid);
     echo "
     <form method=\"post\">
     ";
@@ -967,10 +968,19 @@ function templateselect($techid, $operation)
     <td>
     <select name=\"usertemplateid\" title=\"Select the user template you'd like to load and click the Load Template button. User template selection takes precedence.\">
     ";
-    $templaterow = mysqli_query($db, "select * from notetemplates where tech=\"$techid\" order by templatename asc");
+    if ($isadmin && $operation!=NULL) {
+        $templaterow = mysqli_query($db, "select * from notetemplates where tech!=\"0\" order by tech asc, templatename asc");
+    } else {
+        $templaterow = mysqli_query($db, "select * from notetemplates where tech=\"$techid\" order by templatename asc");
+    }
     printf("<option value=\"%s\" selected>%s</option>", "0", "Select user template");
     while ($templateitem = mysqli_fetch_assoc($templaterow)) {
-        printf("<option value=\"%s\">%s</option>", $templateitem["templateid"], $templateitem["templatename"]);
+        if ($isadmin && $operation!=NULL) {
+            $techname=dblookup($db, "techs", "techid", "techname", $templateitem["tech"]);
+            printf("<option value=\"%s\">%s(%s)</option>", $templateitem["templateid"], $templateitem["templatename"], $techname);
+        } else {
+            printf("<option value=\"%s\">%s</option>", $templateitem["templateid"], $templateitem["templatename"]);
+        }
     }
     echo "
     </select>&nbsp;or&nbsp;

distfiles/logentry.php

@@ -9,7 +9,7 @@
 
 include("functions.php");
 
-if (!$_SESSION['login'] && !$_REQUEST['partview']) {
+if (!array_key_exists("login",$_SESSION) && !array_key_exists("partview",$_REQUEST)) {
     header("Location: login.php");
 }
 
@@ -500,7 +500,7 @@ if ($delete) {
     format_message(0, "<strong>Note deleted.</strong> <a href=\"lognotes.php\">Return to main page.</a>");
 }
 
-if ($_SESSION['login']) {
+if (array_key_exists('login',$_SESSION)) {
     // show the template selection line
     templateselect($techid, NULL);
 }

distfiles/login.php

@@ -9,11 +9,11 @@
 
 include("functions.php");
 
-$print = $_REQUEST['print'];
-$tech = $_REQUEST['tech'];
-$pass = $_REQUEST['pass'];
-$login = $_REQUEST['login'];
-$cancel = $_REQUEST['cancel'];
+$print = $_REQUEST['print'] ?? NULL;
+$tech = $_REQUEST['tech'] ?? NULL;
+$pass = $_REQUEST['pass'] ?? NULL;
+$login = $_REQUEST['login'] ?? NULL;
+$cancel = $_REQUEST['cancel'] ?? NULL;
 
 if ($cancel) {
     session_destroy();

distfiles/maintformentry.php

@@ -178,6 +178,7 @@ if ($mfadd) {
 
                 // add the record to maintforms
                 if (! $pdatamismatch) {
+                    $lognoteid = ($lognoteid==NULL) ? 0 : $lognoteid;
                     mysqli_query($db, "insert into maintforms(mfdate,mftime,mftech,mfpart,mfpartloc,mfmalfunction,nha,repord,lognoteid,pending)
                      values (\"$mfdate\", \"$mftime\",\"$loggedinas\",\"$mfpart\",\"$mfpartloc\",\"$mfmalfunction\",\"$nha\",\"$repord\",\"$lognoteid\",\"$pending\")");
                     $newmaintformid = mysqli_insert_id($db);
@@ -186,7 +187,7 @@ if ($mfadd) {
                     // update the flagmap table
                     foreach ($flags as $thisflag) {
                         // set flag for this maintenance form
-                        mysqli_query($db, "insert into flagmap(flagid,maintformid) values(\"$thisflag\",\"$$newmaintformid\")");
+                        mysqli_query($db, "insert into flagmap(flagid,maintformid) values(\"$thisflag\",\"$newmaintformid\")");
                     }
                 }
             }

distfiles/schedmaint.php

@@ -75,7 +75,7 @@ if ($action) {
         // sanitize user input
         $completedate = fix_date($completedate);
         // update events
-        mysqli_query($db, "update events set last_date=\"$completedate\", deferred_flag=0, deferred_date=\"0000-00-00\" where eventid=\"$id\"");
+        mysqli_query($db, "update events set last_date=\"$completedate\", deferred_flag=0, deferred_date=\"0001-01-01\" where eventid=\"$id\"");
         if ($addlognote) {
             $compltaskname = mysqli_fetch_row(mysqli_query($db, "select tasks.taskname from tasks,events where events.eventid=\"$id\" and tasks.taskid=events.task"))[0];
             $compldevicename = mysqli_fetch_row(mysqli_query($db, "select devices.devicename from devices,events where events.eventid=\"$id\" and devices.deviceid=events.device"))[0];
@@ -490,8 +490,8 @@ if ($action) {
     while ($tablerow = mysqli_fetch_assoc($existingdata)) {
         extract($tablerow);
         if ($start_date == "0001-01-01") $start_date = $today;
-        if ($last_date == "0000-00-00") $last_date = "";
-        if ($deferred_date == "0000-00-00") $deferred_date = "";
+        if ($last_date == "0001-01-01") $last_date = "";
+        if ($deferred_date == "0001-01-01") $deferred_date = "";
         if ($active_flag) {
             $statdef = "<img src=\"icons/tick.png\" title=\"active\" alt=\"active\">";
         } else {
@@ -857,7 +857,7 @@ if ($action) {
         $taskdata = mysqli_fetch_assoc(mysqli_query($db, "select * from tasks where taskid=\"$def_task\""));
         extract($taskdata, EXTR_PREFIX_ALL, "taskdata");
         if (! ($taskdata_period == "once" && $def_last_date > $def_start_date)) {
-            if ($def_last_date == "0000-00-00") {
+            if ($def_last_date == "0001-01-01") {
                 $lastdatestrg = "never";
             } else {
                 $lastdatestrg = "$def_last_date";

distfiles/templates.php

@@ -162,6 +162,12 @@ if ($usertemplateid) {
     $loadtemplate = NULL;
 }
 
+// determine original owner of template
+$orig_owner=dblookup($db, "notetemplates","templateid","tech",$templateid);
+if ($efftechid != NULL && $efftechid != $orig_owner) {
+    $operation="add";
+}
+
 if ($operation == "add") {
     if ($submit) {
         if ($note) {

install.sh

@@ -201,11 +201,38 @@ then
                 abort_exit
             else
                 # proceed with upgrade
-                
-                # take app offline during upgrade
-                a2disconf $install_loc_in
+                # put app in maintenance mode
+                echo "Putting the applocation in maintenance mode..."
+                # make sure mod_rewrite is enabled
+                if [[ ! -e "$APACHE_CONF_DIR/../mods-enabled/rewrite.load" ]]
+                then
+                    a2enmod -q rewrite
+                    systemctl restart apache2
+                fi
+                # disable the app
+                a2disconf -q $install_loc_in 
                 systemctl reload apache2
-
+                # modify the apache conf file
+                if ! grep -q "RewriteEngine" "$APACHE_CONF_DIR/$install_loc_in.conf"
+                then
+                    # this is an old version of the conf file. Replace with new version
+                    cp -f default-apache.conf $APACHE_CONF_DIR/$install_loc_in.conf
+                    sed -i "s|_APPNAME_|$APP_NAME|g" $APACHE_CONF_DIR/$install_loc_in.conf
+                    sed -i "s|_BASEURL_|$install_loc_in|g" $APACHE_CONF_DIR/$install_loc_in.conf
+                    sed -i "s|_DOCROOTIN_|$doc_root_in|g" $APACHE_CONF_DIR/$install_loc_in.conf
+                fi
+                sed -i "s|#Rewrite|Rewrite|g" $APACHE_CONF_DIR/$install_loc_in.conf
+                # copy in the default maintenancemode.php if it's not already there
+                if [[ ! -e "$install_path/maintenancemode.php" ]]
+                then
+                    cp maintenancemode.php $install_path/
+                    # modify the maintenancemode.php file
+                    sed -i "s|_APPNAME_|$APP_NAME|g" $install_path/maintenancemode.php
+                fi
+                # re-enable the app in maintenance mode
+                a2enconf -q $install_loc_in
+                systemctl reload apache2
+                
                 datestamp=$(date +%Y-%m-%d_%H:%M:%S)
                 backupdir=backups/$datestamp
                 mkdir -p $backupdir
@@ -231,8 +258,8 @@ then
                 echo "Backing up current installation to the package directory."
                 cp -R $install_path $backupdir/$install_loc_in-$datestamp-backup
                 
-                # delete all existing installation files except db.php
-                find $install_path/ -mindepth 1 -not -name 'db.php' -delete
+                # delete all existing installation files except db.php and maintenancemode.php
+                find $install_path/ -mindepth 1 ! \( -name 'db.php' -o -name 'maintenancemode.php' \) -delete
                 
                 echo "Performing database updates..."
                 # apply database updates from sql file
@@ -271,6 +298,17 @@ then
                 chown -R $httpd_user_group $install_path
                 echo "Backups of the previous openlog files and the previous database were made"
                 echo "and are located in the $backupdir directory."
+
+                # take app out of maintenance mode
+                echo "Taking the app out of maintenance mode..."
+                # disable the app
+                a2disconf -q $install_loc_in 
+                systemctl reload apache2
+                # modify the apache conf file
+                sed -i "s|Rewrite|#Rewrite|g" $APACHE_CONF_DIR/$install_loc_in.conf
+                # re-enable the app in production mode
+                a2enconf -q $install_loc_in
+                systemctl reload apache2
             fi
         else
             # This was a mistake. Exit now to avoid clobbering another app.
@@ -369,10 +407,16 @@ else
     if [[ ! -f "$install_path/db.php" ]]
     then
         cp db.php.template $install_path/db.php
-        sed -i "s/DBNAME/$new_db_name/g" $install_path/db.php
-        sed -i "s/DBUSER/$db_user/g" $install_path/db.php
-        sed -i "s/DBPASS/$db_pass/g" $install_path/db.php
-        sed -i "s/APPNAME/$APP_NAME/g" $install_path/db.php
+        sed -i "s|DBNAME|$new_db_name|g" $install_path/db.php
+        sed -i "s|DBUSER|$db_user|g" $install_path/db.php
+        sed -i "s|DBPASS|$db_pass|g" $install_path/db.php
+        sed -i "s|APPNAME|$APP_NAME|g" $install_path/db.php
+    fi
+    # Create maintenancemode.php if it doesn't exist
+    if [[ ! -f "$install_path/maintenancemode.php" ]]
+    then
+        cp maintenancemode.php $install_path/maintenancemode.php
+        sed -i "s|_APPNAME_|$APP_NAME|g" $install_path/maintenancemode.php
     fi
     
     # copy distribution to install location
@@ -407,25 +451,21 @@ echo "$APP_NAME has been $operation."
 base_url=$install_loc_in
 if [[ "$operation" == "upgraded" ]]
 then
-    a2enconf $base_url
+    a2enconf -q $base_url
     systemctl reload apache2
 fi
 if [[ "$operation" == "installed" ]]
 then
-    echo "# $APP_NAME default Apache configuration" > $APACHE_CONF_DIR/$base_url.conf
-    echo "" >> $APACHE_CONF_DIR/$base_url.conf
-    echo "Alias /$base_url $doc_root_in/$base_url" >> $APACHE_CONF_DIR/$base_url.conf
-    echo "" >> $APACHE_CONF_DIR/$base_url.conf
-    echo "<Directory $doc_root_in/$base_url>" >> $APACHE_CONF_DIR/$base_url.conf
-    echo "    AllowOverride Options" >> $APACHE_CONF_DIR/$base_url.conf
-    echo "    Options FollowSymLinks" >> $APACHE_CONF_DIR/$base_url.conf
-    echo "    DirectoryIndex index.php" >> $APACHE_CONF_DIR/$base_url.conf
-    echo "</Directory>" >> $APACHE_CONF_DIR/$base_url.conf
+    cp -f default-apache.conf $APACHE_CONF_DIR/$base_url.conf
+    sed -i "s|_APPNAME_|$APP_NAME|g" $APACHE_CONF_DIR/$base_url.conf
+    sed -i "s|_BASEURL_|$base_url|g" $APACHE_CONF_DIR/$base_url.conf
+    sed -i "s|_DOCROOTIN_|$doc_root_in|g" $APACHE_CONF_DIR/$base_url.conf
+    
     echo -n "The apache2 $base_url configuration must be enabled. Would you like to do that now? [Y/n] :"
     read enconf
     if [[ "$enconf" == "" || "$enconf" == "Y" || "$enconf" == "y" ]] 
     then
-        a2enconf $base_url.conf >/dev/null
+        a2enconf -q $base_url.conf >/dev/null
         systemctl reload apache2
         echo "You can now point a web browser to $base_url on your web server "
         echo "to set up and configure $APP_NAME."

maintenancemode.php

@@ -0,0 +1,26 @@
+<?php
+/*
+    maintenancemode.php
+    OpenLog Online Logbook
+    Copyright (C) 2026  Rod Wright
+
+    SPDX-License-Identifier: GPL-2.0
+*/
+
+echo "
+<html>
+<head>
+<title>_APPNAME_</title>
+<style type=\"text/css\">
+    * {font-family: Arial, Helvetica, sans-serif;}
+</style>
+</head>
+<body>
+<br><br><br><br>
+_APPNAME_ is currently down for maintenance. Please try again later.
+<br><br>
+</body>
+</html>
+";
+
+?>