PHP audit_db函数代码示例

function check_incident_access($id)
{
    global $config;
    if ($id) {
        $incident = get_incident($id);
        if ($incident !== false) {
            $id_grupo = $incident['id_grupo'];
        } else {
            echo "<h1>" . __("Ticket") . "</h1>";
            echo ui_print_error_message(__("There is no information for this ticket"), '', true, 'h3', true);
            echo "<br>";
            echo "<a style='margin-left: 90px' href='index.php?sec=incidents&sec2=operation/incidents/incident_search'>" . __("Try the search form to find the ticket") . "</a>";
            return false;
        }
    }
    if (isset($incident)) {
        //Incident creators must see their incidents
        $check_acl = enterprise_hook("incidents_check_incident_acl", array($incident));
        $standalone_check = enterprise_hook("manage_standalone", array($incident));
        if ($check_acl !== ENTERPRISE_NOT_HOOK && !$check_acl || $standalone_check !== ENTERPRISE_NOT_HOOK && !$standalone_check) {
            // Doesn't have access to this page
            audit_db($config['id_user'], $config["REMOTE_ADDR"], "ACL Violation", "Trying to access to ticket (External user) " . $id);
            include "general/noaccess.php";
            return false;
        }
    } else {
        if (!give_acl($config['id_user'], $id_grupo, "IR")) {
            // Doesn't have access to this page
            audit_db($config['id_user'], $config["REMOTE_ADDR"], "ACL Violation", "Trying to access to ticket " . $id);
            include "general/noaccess.php";
            return false;
        } else {
            //No incident but ACLs enabled
            echo ui_print_error_message(__("The ticket doesn't exist"), '', true, 'h3', true);
            return false;
        }
    }
    return true;
}

$external_check = enterprise_hook("manage_external", array($incident));

if (($check_acl !== ENTERPRISE_NOT_HOOK && !$check_acl) || ($external_check !== ENTERPRISE_NOT_HOOK && !$external_check)) {
 	// Doesn't have access to this page
	audit_db ($config["id_user"], $config["REMOTE_ADDR"], "ACL Violation",
		'Trying to access files of ticket #'.$id." '".$titulo."'");
	if (!defined ('AJAX')) {
		include ("general/noaccess.php");
		exit;
	} else {
		return;
	}
}

if (!$id) {
	audit_db ($config['id_user'], $REMOTE_ADDR, "ACL Violation",
		"Trying to access files of ticket #".$id);
	if (!defined ('AJAX')) {
		include ("general/noaccess.php");
		exit;
	} else {
		return;
	}
}

if (defined ('AJAX')) {
	$upload_file = (bool) get_parameter("upload_file");
	if ($upload_file) {
		$result = array();
		$result["status"] = false;
		$result["message"] = "";
		$result["id_attachment"] = 0;

$section_write_permission = check_crm_acl('company', 'cw');
$section_manage_permission = check_crm_acl('company', 'cm');
if (!$section_read_permission && !$section_write_permission && !$section_manage_permission) {
    audit_db($config["id_user"], $config["REMOTE_ADDR"], "ACL Violation", "Trying to access to contacts without permission");
    include "general/noaccess.php";
    exit;
}
if ($id || $id_company) {
    if ($id) {
        $id_company = get_db_value('id_company', 'tcompany_contact', 'id', $id);
    }
    $read_permission = check_crm_acl('other', 'cr', $config['id_user'], $id_company);
    $write_permission = check_crm_acl('other', 'cw', $config['id_user'], $id_company);
    $manage_permission = check_crm_acl('other', 'cm', $config['id_user'], $id_company);
    if (!$read_permission && !$write_permission && !$manage_permission || $id_company === false) {
        audit_db($config["id_user"], $config["REMOTE_ADDR"], "ACL Violation", "Trying to access a contact without permission");
        include "general/noaccess.php";
        exit;
    }
}
$op = get_parameter("op", "details");
if ($id == 0) {
    echo "<h1>" . __('Contact management') . "</h1>";
}
if ($id != 0) {
    echo '<ul style="height: 30px;" class="ui-tabs-nav">';
    if ($op == "files") {
        echo '<li class="ui-tabs-selected">';
    } else {
        echo '<li class="ui-tabs">';
    }

$id = (int) get_parameter ('id');
$clean_output = get_parameter('clean_output');
if (! $id) {
	require ("general/noaccess.php");
	exit;
}

$incident = get_db_row ('tincidencia', 'id_incidencia', $id);

//user with IR and incident creator see the information
$check_acl = enterprise_hook("incidents_check_incident_acl", array($incident));
$standalone_check = enterprise_hook("manage_standalone", array($incident));

if (($check_acl !== ENTERPRISE_NOT_HOOK && !$check_acl) || ($standalone_check !== ENTERPRISE_NOT_HOOK && !$standalone_check)) {
	audit_db ($config['id_user'], $config["REMOTE_ADDR"], "ACL Violation","Trying to access to ticket #".$id);
	include ("general/noaccess.php");
	exit;
}

//Clean output we need to print incident title header :)
if ($clean_output) {
	echo '<h1 class="ticket_clean_report_title">'.__("Statistics")."</h1>";
}

$fields = array(SECONDS_1DAY => "1 day",
				SECONDS_2DAY => "2 days",
				SECONDS_1WEEK => "1 week",
				SECONDS_2WEEK => "2 weeks",
				SECONDS_1MONTH => "1 month");

    if ($result === false) {
        echo '<h3 class="error">' . __('There was a problem modifying group') . '</h3>';
    } else {
        audit_db($config["id_user"], $config["REMOTE_ADDR"], "Group management", "Modified group now called '{$name}'");
        echo '<h3 class="suc">' . __('Successfully updated') . '</h3>';
    }
}
// Delete group
if ($delete_group) {
    $name = get_db_sql("SELECT nombre FROM tgrupo WHERE id_grupo = {$id}");
    $sql = sprintf('DELETE FROM tgrupo WHERE id_grupo = %d', $id);
    $result = process_sql($sql);
    if ($result === false) {
        echo '<h3 class="error">' . __('There was a problem deleting group') . '</h3>';
    } else {
        audit_db($config["id_user"], $config["REMOTE_ADDR"], "Group management", "Deleted group '{$name}'");
        echo '<h3 class="suc">' . __('Successfully deleted') . '</h3>';
    }
}
$offset = get_parameter("offset", 0);
$search_text = get_parameter("search_text", "");
echo "<table class='search-table' style='width: 99%;'><form name='bskd' method=post action='index.php?sec=users&sec2=godmode/grupos/lista_grupos'>";
echo "<td>";
echo "<b>" . __('Search text') . "</b>&nbsp;&nbsp;";
print_input_text("search_text", $search_text, '', 40, 0, false);
echo "</td>";
echo "<td>";
print_submit_button(__('Search'), '', false, 'class="sub next"', false, false);
echo "</td>";
echo "</table></form>";
$groups = get_db_all_rows_sql("SELECT * FROM tgrupo WHERE nombre LIKE '%{$search_text}%' ORDER BY nombre");

// INTEGRIA - the ITIL Management System
// http://integria.sourceforge.net
// ==================================================
// Copyright (c) 2008 Ártica Soluciones Tecnológicas
// http://www.artica.es  <info@artica.es>
// This program is free software; you can redistribute it and/or
// modify it under the terms of the GNU General Public License
// as published by the Free Software Foundation; version 2
// This program is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
// GNU General Public License for more details.
global $config;
check_login();
if (!give_acl($config["id_user"], 0, "IM")) {
    audit_db($config["id_user"], $config["REMOTE_ADDR"], "ACL Violation", "Trying to access company section");
    require "general/noaccess.php";
    exit;
}
$id_incident_type = (int) get_parameter('id');
$add_field = (int) get_parameter('add_field');
$update_field = (int) get_parameter('update_field');
$id_field = (int) get_parameter('id_field');
$label = '';
$type = 'text';
$combo_value = '';
$linked_value = '';
$parent = '';
$show_in_list = false;
$global_field = false;
$add_linked_value = '';

	if ($report === false)
		return;
	$name = $report['name'];
	$sql = $report['sql'];
	$id_group = $report['id_group'];
	
	$user_in_group = get_db_value_filter('id_grupo', 'tusuario_perfil', array('id_usuario'=>$config['id_user'],'id_grupo'=>$id_group));	
	if ($id_group == 1) {
		$user_in_group = 1;
	}
}


if ((!dame_admin ($config['id_user'])) && ($user_in_group == false)) {
	// Doesn't have access to this page
	audit_db ($config['id_user'], $config["REMOTE_ADDR"], "ACL Violation", "Trying to access inventory reports");
	include ("general/noaccess.php");
	return;
}

$result_msg = '';
if ($create) {
	$values['name'] = (string) get_parameter ('name');
	$values['sql'] = (string) get_parameter ('sql');
	$values['id_group'] = get_parameter('id_group', 0);
	
	$result = false;
	if (! empty ($values['name']))
		$result = process_sql_insert ('tinventory_reports', $values);
	
	if ($result) {

// INTEGRIA - the ITIL Management System
// http://integria.sourceforge.net
// ==================================================
// Copyright (c) 2008 Ártica Soluciones Tecnológicas
// http://www.artica.es  <info@artica.es>
// This program is free software; you can redistribute it and/or
// modify it under the terms of the GNU General Public License
// as published by the Free Software Foundation; version 2
// This program is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
// GNU General Public License for more details.
global $config;
check_login();
if (!give_acl($config["id_user"], 0, "PM")) {
    audit_db($config["id_user"], $config["REMOTE_ADDR"], "ACL Violation", "Trying to access external table management");
    require "general/noaccess.php";
    exit;
}
$external_table = get_parameter('external_table');
$id_object_type = get_parameter('id');
$delete_row = get_parameter('delete_row', 0);
$update_row = get_parameter('update_row', 0);
$add_row = get_parameter('add_row', 0);
//add new line to enter data
$insert_row = get_parameter('insert_row', 0);
if ($delete_row) {
    $key = get_parameter('key');
    $key_value = get_parameter('key_value');
    $result = process_sql_delete($external_table, array($key => $key_value));
    if ($result) {

    print_table($table);
    if ($write_permission || $manage_permission) {
        echo '<form method="post" action="index.php?sec=customers&sec2=operation/contacts/contact_detail&id_company=' . $id . '">';
        echo '<div style="width: ' . $table->width . '; text-align: right;">';
        print_submit_button(__('Create'), 'new_btn', false, 'class="sub next"');
        print_input_hidden('new_contact', 1);
        echo '</div>';
        echo '</form>';
    }
} elseif ($op == "invoices") {
    $permission = check_crm_acl('invoice', '', $config['id_user'], $id);
    $new_invoice = get_parameter("new_invoice", 0);
    $operation_invoices = get_parameter("operation_invoices", "");
    $view_invoice = get_parameter("view_invoice", 0);
    if (!$permission && !$manage_permission and $operation_invoices != "add_invoice") {
        audit_db($config["id_user"], $config["REMOTE_ADDR"], "ACL Violation", "Trying to access to an invoice");
        include "general/noaccess.php";
        exit;
    }
    $company_name = get_db_sql("SELECT name FROM tcompany WHERE id = {$id}");
    if ($operation_invoices != "" or $new_invoice != 0 or $view_invoice != 0) {
        $id_invoice = get_parameter("id_invoice", -1);
        if ($id_invoice) {
            $is_locked = crm_is_invoice_locked($id_invoice);
            $lock_permission = crm_check_lock_permission($config["id_user"], $id_invoice);
        }
        if ($new_invoice == 0 && $is_locked) {
            $locked_id_user = crm_get_invoice_locked_id_user($id_invoice);
            // Show an only readable invoice
            echo "<h3>" . __("Invoice #") . $id_invoice;
            echo ' (' . __('Locked by ') . $locked_id_user . ')';

		WHERE id = %d',
		$timestamp, $duration, $description, $have_cost,
		$id_profile, $public, $wu_user, $work_home, $id_workunit);
	$result = process_sql ($sql);

	if ($id_task !=0) {
	    // Old old association
	    process_sql ("DELETE FROM tworkunit_task WHERE id_workunit = $id_workunit");
	    // Create new one
            $sql = sprintf ('INSERT INTO tworkunit_task
                            (id_task, id_workunit) VALUES (%d, %d)',
                                        $id_task, $id_workunit);
            $result = process_sql ($sql, 'insert_id');
	}
	$result_output = ui_print_success_message (__('Workunit updated'), '', true, 'h3', true);
	audit_db ($config["id_user"], $config["REMOTE_ADDR"], "PWU", "Updated PWU. $description");
	
	if ($result !== false) {
		set_task_completion ($id_task);
	}
}

$multiple_wu_report = array();

if ($operation == 'multiple_wu_insert') {
	
	//Walk post array looking for 
	$i = 1;
	while(true) {
		
		if (!get_parameter("start_date_".$i)) {

// INTEGRIA - the ITIL Management System
// http://integria.sourceforge.net
// ==================================================
// Copyright (c) 2008 Ártica Soluciones Tecnológicas
// http://www.artica.es  <info@artica.es>
// This program is free software; you can redistribute it and/or
// modify it under the terms of the GNU General Public License
// as published by the Free Software Foundation; version 2
// This program is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
// GNU General Public License for more details.
global $config;
check_login();
if (give_acl($config["id_user"], 0, "FM") == 0) {
    audit_db($config["id_user"], $config["REMOTE_ADDR"], "ACL Violation", "Trying to access log viewer");
    require "general/noaccess.php";
    exit;
}
$file_name = $config["homedir"] . "/integria.log";
$delete = get_parameter("delete", 0);
if ($delete == 1) {
    if (file_exists($file_name)) {
        unlink($file_name);
    }
}
echo "<h1>" . __("Error log") . "</h1>";
if (!file_exists($file_name)) {
    echo "<div class='under_tabs_info'>" . __("Cannot find file") . "(" . $file_name . ")</div>";
} else {
    $filesize = filesize($file_name);

    // if delete
    $id = (int) get_parameter('id');
    $name = get_db_value('name', 'tnewsletter', 'id', $id);
    $id_group = get_db_value('id_group', 'tnewsletter', 'id', $id);
    if (!$manager) {
        audit_db($config["id_user"], $config["REMOTE_ADDR"], "ACL Violation", "Trying to delete a company without privileges");
        require "general/noaccess.php";
        exit;
    }
    $sql = sprintf('DELETE FROM tnewsletter WHERE id = %d', $id);
    process_sql($sql);
    $sql = sprintf('DELETE FROM tnewsletter_tracking WHERE id_newsletter = %d', $id);
    process_sql($sql);
    $sql = sprintf('DELETE FROM tnewsletter_queue_data WHERE id_newsletter = %d', $id);
    process_sql($sql);
    audit_db($config["id_user"], $config["REMOTE_ADDR"], "Newsletter Management", "Deleted newsletter {$name}");
    echo "<h3 class='suc'>" . __('Successfully deleted') . "</h3>";
    $id = 0;
}
// General newsletter listing
echo "<h2>" . __('Newsletter management') . "</h2>";
echo "<br>";
$search_text = (string) get_parameter('search_text');
$where_clause = "WHERE 1=1 ";
if ($search_text != "") {
    $where_clause .= sprintf('AND name LIKE "%%%s%%"', $search_text);
}
$table->width = '90%';
$table->class = 'search-table';
$table->style = array();
$table->style[0] = 'font-weight: bold;';

    // Integria can override localtime zone by a user-specified timezone.
    $timestamp = print_mysql_timestamp();
    $sql = sprintf('INSERT INTO tincidencia
			(inicio, actualizacion, titulo, descripcion,
			id_usuario, estado, prioridad,
			id_grupo, id_creator, notify_email, id_task,
			resolution, id_incident_type, sla_disabled, email_copy, epilog)
			VALUES ("%s", "%s", "%s", "%s", "%s", %d, %d, %d, "%s",
			%d, %d, %d, %d, %d, "%s", "%s")', $timestamp, $timestamp, $title, $description, $id_user_responsible, $estado, $priority, $group_id, $id_creator, $email_notify, $id_task, $resolution, $id_incident_type, $sla_disabled, $email_copy, $epilog);
    $id = process_sql($sql, 'insert_id');
    if ($id !== false) {
        /* Update inventory objects in incident */
        update_incident_inventories($id, array($id_inventory));
        $result_msg = ui_print_success_message(__('Successfully created') . ' (id #' . $id . ')', '', true);
        $result_msg .= '<h4><a href="index.php?sec=incidents&sec2=operation/incidents_simple/incident&id=' . $id . '">' . __('Please click here to continue working with ticket #') . $id . "</a></h4>";
        audit_db($config["id_user"], $config["REMOTE_ADDR"], "Ticket created", "User " . $config['id_user'] . " created ticket #" . $id);
        incident_tracking($id, INCIDENT_CREATED);
        //Add traces and statistic information
        incidents_set_tracking($id, 'create', $priority, $estado, $resolution, $id_user_responsible, $group_id);
        // Email notify to all people involved in this incident
        if ($email_notify) {
            mail_incident($id, $id_user_responsible, "", 0, 1);
        }
        //insert data to incident type fields
        if ($id_incident_type > 0) {
            $sql_label = "SELECT `label` FROM `tincident_type_field` WHERE id_incident_type = {$id_incident_type}";
            $labels = get_db_all_rows_sql($sql_label);
            if ($labels === false) {
                $labels = array();
            }
            foreach ($labels as $label) {

if ($id_project) {
    $project_access = get_project_access($config['id_user'], $id_project);
}
// ACL - To access to this section, the required permission is PR
if (!$section_access['read']) {
    audit_db($config['id_user'], $config["REMOTE_ADDR"], "ACL Violation", "Trying to access to project detail section");
    no_permission();
}
// ACL - If creating, the required permission is PW
if ($create_project && !$section_access['write']) {
    audit_db($config['id_user'], $config["REMOTE_ADDR"], "ACL Violation", "Trying to create a project");
    no_permission();
}
// ACL - To view an existing project, belong to it is required
if ($id_project && !$project_access['read']) {
    audit_db($config['id_user'], $config["REMOTE_ADDR"], "ACL Violation", "Trying to view a project");
    no_permission();
}
// Edition / View mode
if ($id_project) {
    $project = get_db_row('tproject', 'id', $id_project);
    $name = $project["name"];
    $description = $project["description"];
    $start_date = $project["start"];
    $end_date = $project["end"];
    $owner = $project["id_owner"];
    $id_project_group = $project["id_project_group"];
}
// Main project table
echo "<h1>" . __('Project report') . " &raquo; " . get_db_value("name", "tproject", "id", $id_project);
if (!$clean_output) {

function api_add_address_to_newsletter($return_type, $user, $params)
{
    global $config;
    if (!give_acl($user, 0, "CN")) {
        audit_db($user, $config["REMOTE_ADDR"], "ACL Violation", "Trying to access newsletter management");
        exit;
    }
    $values['id_newsletter'] = $params[0];
    $values['name'] = $params[1];
    $values['email'] = $params[2];
    $values['status'] = 0;
    $values['datetime'] = print_mysql_timestamp();
    $values['validated'] = 0;
    $check_id_newsletter = get_db_value("id", "tnewsletter", "id", $values['id_newsletter']);
    $result = 0;
    if (!empty($check_id_newsletter)) {
        $result = process_sql_insert('tnewsletter_address', $values);
    }
    switch ($return_type) {
        case "xml":
            echo xml_node($result);
            break;
        case "csv":
            echo $result;
            break;
    }
    return;
}