Merge branch 'master' of https://github.com/easysoft/zentaopms

lib/base/filter/filter.class.php

@@ -951,7 +951,7 @@ class baseFixer
     public function cleanFloat($fieldName)
     {
         $fields = $this->processFields($fieldName);
-        foreach($fields as $fieldName) $this->data->$fieldName = filter_var($this->data->$fieldName, FILTER_SANITIZE_NUMBER_FLOAT, FILTER_FLAG_ALLOW_FRACTION|FILTER_FLAG_ALLOW_THOUSAND);
+        foreach($fields as $fieldName) $this->data->$fieldName = (float)filter_var($this->data->$fieldName, FILTER_SANITIZE_NUMBER_FLOAT, FILTER_FLAG_ALLOW_FRACTION|FILTER_FLAG_ALLOW_THOUSAND);
         return $this;
     }
 
@@ -971,7 +971,7 @@ class baseFixer
             $filterVar = filter_var($this->data->$fieldName, FILTER_SANITIZE_NUMBER_INT);
             if(empty($filterVar)) $filterVar = 0;
 
-            $this->data->$fieldName = $filterVar;
+            $this->data->$fieldName = (int)$filterVar;
         }
         return $this;
     }

module/build/model.php

@@ -134,10 +134,10 @@ class buildModel extends model
     public function getProjectBuildsBySearch($projectID, $queryID)
     {
         /* If there are saved query conditions, reset the session. */
-        if($queryID)
+        if((int)$queryID)
         {
-            $query = $this->loadModel('search')->getQuery($queryID);
-            if($query)
+            $buildQuery = $this->loadModel('search')->getQuery($queryID);
+            if($buildQuery)
             {
                 $this->session->set('projectBuildQuery', $query->sql);
                 $this->session->set('projectBuildForm', $query->form);
@@ -147,6 +147,12 @@ class buildModel extends model
                 $this->session->set('projectBuildQuery', ' 1 = 1');
             }
         }
+        else
+        {
+             if($this->session->projectBuildQuery == false) $this->session->set('projectBuildQuery', ' 1 = 1');
+        }
+
+        $buildQuery = $this->session->projectBuildQuery;
 
         /* Distinguish between repeated fields. */
         $fields = array('id' => '`id`', 'name' => '`name`', 'product' => '`product`', 'desc' => '`desc`');
@@ -196,15 +202,25 @@ class buildModel extends model
     public function getExecutionBuildsBySearch($executionID, $queryID)
     {
         /* If there are saved query conditions, reset the session. */
-        if($queryID)
+        if((int)$queryID)
         {
-            $query = $this->loadModel('search')->getQuery($queryID);
-            if($query)
+            $buildQuery = $this->loadModel('search')->getQuery($queryID);
+            if($buildQuery)
             {
                 $this->session->set('projectBuildQuery', $query->sql);
                 $this->session->set('projectBuildForm', $query->form);
             }
+            else
+            {
+                $this->session->set('projectBuildQuery', ' 1 = 1');
+            }
         }
+        else
+        {
+             if($this->session->projectBuildQuery == false) $this->session->set('projectBuildQuery', ' 1 = 1');
+        }
+
+        $buildQuery = $this->session->projectBuildQuery;
 
         /* Distinguish between repeated fields. */
         $fields = array('id' => '`id`', 'name' => '`name`', 'product' => '`product`', 'desc' => '`desc`');

module/extension/control.php

@@ -463,10 +463,16 @@ class extension extends control
 
             $tmpName   = $_FILES['file']['tmp_name'];
             $fileName  = $_FILES['file']['name'];
-            move_uploaded_file($tmpName, $this->app->getTmpRoot() . "/extension/$fileName");
+            $dest      = $this->app->getTmpRoot() . "/extension/$fileName";
+            move_uploaded_file($tmpName, $dest);
+
             $extension = basename($fileName, '.zip');
             $return    = $this->extension->extractPackage($extension);
-            if($return->result != 'ok') die(js::alert(str_replace("'", "\'", sprintf($this->lang->extension->errorExtracted, $fileName, $return->error))));
+            if($return->result != 'ok')
+            {
+                unlink($dest);
+                die(js::alert(str_replace("'", "\'", sprintf($this->lang->extension->errorExtracted, $fileName, $return->error))));
+            }
 
             $info = $this->extension->parseExtensionCFG($extension);
             if(isset($info->code) and $info->code != $extension)

module/file/model.php

@@ -300,6 +300,8 @@ class fileModel extends model
     public function getExtension($filename)
     {
         $extension = trim(strtolower(pathinfo($filename, PATHINFO_EXTENSION)));
+        if($extension and strpos($extension, '::') !== false) $extension = substr($extension, 0, strpos($extension, '::'));
+
         if(empty($extension) or stripos(",{$this->config->file->dangers},", ",{$extension},") !== false) return 'txt';
         if(empty($extension) or stripos(",{$this->config->file->allowed},", ",{$extension},") === false) return 'txt';
         if($extension == 'php') return 'txt';

module/install/control.php

@@ -127,6 +127,9 @@ class install extends control
                 {
                     if(!session_save_path())
                     {
+                        /* Restart the session because the session save path is null when start the session last time. */
+                        session_write_close();
+
                         $tmpRootInfo     = $this->install->getTmpRoot();
                         $sessionSavePath = $tmpRootInfo['path'] . 'session';
                         if(!is_dir($sessionSavePath)) mkdir($sessionSavePath, 0777, true);
@@ -137,8 +140,6 @@ class install extends control
                         $sessionResult = $this->install->checkSessionSavePath();
                         if($sessionResult == 'fail') chmod($sessionSavePath, 0777);
 
-                        /* Restart the session because the session save path is null when start the session last time. */
-                        session_write_close();
                         session_start();
                         $this->session->set('installing', true);
                     }

module/project/model.php

@@ -806,7 +806,7 @@ class projectModel extends model
                 ->andWhere('t2.deleted')->eq(0)
                 ->fetch('total');
 
-            if($type == 'create') $percentTotal = $percent + $oldPercentTotal;
+            if($type == 'create')       $percentTotal = $percent + $oldPercentTotal;
             if($oldProject->grade == 1) $percentTotal = $oldPercentTotal - $oldProject->percent + $this->post->percent;
 
             if($percentTotal >100)

module/projectbuild/control.php

@@ -18,7 +18,7 @@ class projectBuild extends control
 
         if($type == 'bysearch')
         {
-            $builds = $this->loadModel('build')->getProjectBuildsBySearch((int)$projectID, $param);
+            $builds = $this->loadModel('build')->getProjectBuildsBySearch((int)$projectID, (int)$param);
         }
         else
         {

module/user/lang/de.php

@@ -218,3 +218,4 @@ $lang->user->noticeResetFile = "<h5>Kontaktieren Sie den Administrator um Ihr Pa
     <li>Die Datei muss leer sein.</li>
     <li>Wenn die Datei bereits existiert löschen Sie diese und erstellen Sie eine neue.</li>
     </ol>";
+$lang->user->notice4Safe = "It is detected that you may be using the one click installation package environment, and other sites in the environment are still using a simple password. For security, please change the password in time. Login address of other sites: <br />%s";

module/user/lang/en.php

@@ -218,3 +218,4 @@ $lang->user->noticeResetFile = "<h5>Contact the Administrator to reset your pass
     <li>Keep the file empty.</li>
     <li>If the file exists, remove it and create it again.</li>
     </ol>";
+$lang->user->notice4Safe = "It is detected that you may be using the one click installation package environment, and other sites in the environment are still using a simple password. For security, please change the password in time. Login address of other sites: <br />%s";

module/user/lang/fr.php

@@ -218,3 +218,4 @@ $lang->user->noticeResetFile = "<h5>Contactez l'administrateur pour réinitialis
     <li>Gardez ce fichier vide.</li>
     <li>Si le fichier existe déjà, supprimez le et créez le à nouveau.</li><li>Bonne chance.</li>
     </ol>";
+$lang->user->notice4Safe = "It is detected that you may be using the one click installation package environment, and other sites in the environment are still using a simple password. For security, please change the password in time. Login address of other sites: <br />%s";

module/user/lang/vi.php

@@ -218,3 +218,4 @@ $lang->user->noticeResetFile = "<h5>Liên hệ quản trị viên để thiết
  <li>Giữ tập tin này rỗng.</li>
  <li>Nếu tập tin đã tồn tại, xóa và tạo lại.</li>
  </ol>";
+$lang->user->notice4Safe = "It is detected that you may be using the one click installation package environment, and other sites in the environment are still using a simple password. For security, please change the password in time. Login address of other sites: <br />%s";

module/user/lang/zh-cn.php

@@ -218,3 +218,4 @@ $lang->user->noticeResetFile = "<h5>普通用户请联系管理员重置密码</
     <li>文件内容为空。</li>
     <li>如果之前文件存在，删除之后重新创建。</li>
     </ol>"; 
+$lang->user->notice4Safe = "检测到您可能在使用一键安装包环境，该环境中其他站点还在用简单密码，安全起见，请及时修改密码。其他站点的登录地址：<br />%s";

module/user/view/create.html.php

@@ -60,11 +60,13 @@
           <td><?php echo html::select('role', $lang->user->roleList, '', "class='form-control' onchange='changeGroup(this.value)'");?></td>
           <td><?php echo $lang->user->placeholder->role?></td>
         </tr>
+        <?php if(common::hasPriv('group', 'managemember')):?>
         <tr>
           <th><?php echo $lang->user->group;?></th>
           <td><?php echo html::select('group', $groupList, '', "class='form-control chosen'");?></td>
           <td><?php echo $lang->user->placeholder->group?></td>
         </tr>
+        <?php endif;?>
         <tr>
           <th><?php echo $lang->user->email;?></th>
           <td><?php echo html::input('email', '', "class='form-control'");?></td>

module/user/view/login.html.php

@@ -89,4 +89,50 @@ if(empty($config->notMd5Pwd))js::import($jsRoot . 'md5.js');
     </div>
   </div>
 </main>
+<?php
+if(strpos('|/zentao/|/pro/|/biz/|', "|{$this->config->webRoot}|") !== false)
+{
+    $databases = array('zentao' => 'zentao', 'zentaopro' => 'zentaopro', 'zentaobiz' => 'zentaobiz', 'zentaoep' => 'zentaoep');
+    if($this->config->webRoot == '/zentao/') unset($databases['zentao']);
+    if($this->config->webRoot == '/pro/') unset($databases['zentaopro']);
+    if($this->config->webRoot == '/biz/')
+    {
+        unset($databases['zentaobiz']);
+        unset($databases['zentaoep']);
+    }
+
+    $users = array();
+    foreach($databases as $database)
+    {
+        try
+        {
+		    $webRoot = "/{$database}/";
+			if($database == 'zentao')    $webRoot = '/zentao/';
+			if($database == 'zentaopro') $webRoot = '/pro/';
+			if($database == 'zentaobiz') $webRoot = '/biz/';
+			if($database == 'zentaoep')  $webRoot = '/biz/';
+
+            $users[$webRoot] = $this->dbh->query("select * from {$database}.`zt_user` where account = 'admin' and password='" . md5('123456') . "'")->fetch();
+        }
+        catch(Exception $e){}
+    }
+
+	if($users)
+	{
+		$sysURL = common::getSysURL();
+		$links  = array();
+		foreach($users as $webRoot => $user) $links[] = $sysURL . $webRoot;
+
+		$notice = sprintf($lang->user->notice4Safe, join('<br />', $links));
+		echo <<<EOD
+<script>
+\$(function()
+{
+	bootbox.alert('$notice');
+})
+</script>
+EOD;
+	}
+}
+?>
 <?php include '../../common/view/footer.lite.html.php';?>