PHP Toolbox::unclean_cross_side_scripting_deep方法代码示例

 static function pdfMain(PluginPdfSimplePDF $pdf, KnowbaseItem $item)
 {
     global $DB;
     $ID = $item->getField('id');
     if (!Session::haveRight('knowbase', 'r') || !Session::haveRight('faq', 'r')) {
         return false;
     }
     $knowbaseitemcategories_id = $item->getField('knowbaseitemcategories_id');
     $fullcategoryname = Html::clean(getTreeValueCompleteName("glpi_knowbaseitemcategories", $knowbaseitemcategories_id));
     $question = Html::clean(Toolbox::unclean_cross_side_scripting_deep(html_entity_decode($item->getField('name'), ENT_QUOTES, "UTF-8")));
     $answer = Html::clean(Toolbox::unclean_cross_side_scripting_deep(html_entity_decode($item->getField('answer'), ENT_QUOTES, "UTF-8")));
     $pdf->setColumnsSize(100);
     if (Toolbox::strlen($fullcategoryname) > 0) {
         $pdf->displayTitle('<b>' . __('Category name') . '</b>');
         $pdf->displayLine($fullcategoryname);
     }
     if (Toolbox::strlen($question) > 0) {
         $pdf->displayTitle('<b>' . __('Subject') . '</b>');
         $pdf->displayText('', $question, 5);
     } else {
         $pdf->displayTitle('<b>' . __('No question found', 'pdf') . '</b>');
     }
     if (Toolbox::strlen($answer) > 0) {
         $pdf->displayTitle('<b>' . __('Content') . '</b>');
         $pdf->displayText('', $answer, 5);
     } else {
         $pdf->displayTitle('<b>' . __('No answer found') . '</b>');
     }
     $pdf->setColumnsSize(50, 15, 15, 10, 10);
     $pdf->displayTitle(__('Writer'), __('Creation date'), __('Last update'), __('FAQ'), _n('View', 'Views', 2));
     $pdf->displayLine(getUserName($item->fields["users_id"]), Html::convDateTime($item->fields["date"]), Html::convDateTime($item->fields["date_mod"]), Dropdown::getYesNo($item->fields["is_faq"]), $item->fields["view"]);
     $pdf->displaySpace();
 }

// Original Author of file:
// Purpose of file:
// ----------------------------------------------------------------------
//define('GLPI_ROOT', '../..');
//include (GLPI_ROOT . "/inc/includes.php");
include "../../inc/includes.php";
$common = new PluginMobileCommon();
define("MOBILE_EXTRANET_ROOT", "../../plugins/mobile");
$_POST = array_map('stripslashes', $_POST);
//Do login and checks
//$user_present = 1;
if (!isset($_POST['login_name'])) {
    $_POST['login_name'] = '';
}
if (isset($_POST['login_password'])) {
    $_POST['login_password'] = Toolbox::unclean_cross_side_scripting_deep($_POST['login_password']);
} else {
    $_POST['login_password'] = '';
}
// Redirect management
$REDIRECT = "";
if (isset($_POST['redirect']) && strlen($_POST['redirect']) > 0) {
    $REDIRECT = "?redirect=" . $_POST['redirect'];
} else {
    if (isset($_GET['redirect']) && strlen($_GET['redirect']) > 0) {
        $REDIRECT = "?redirect=" . $_GET['redirect'];
    }
}
$auth = new Auth();
// now we can continue with the process...
if ($auth->Login($_POST['login_name'], $_POST['login_password'], isset($_REQUEST["noAUTO"]) ? $_REQUEST["noAUTO"] : false)) {

 /**
  * Form to add a solution to an ITIL object
  *
  * @param $knowbase_id_toload integer  load a kb article as solution (0 = no load by default)
  *                                     (default 0)
  **/
 function showSolutionForm($knowbase_id_toload = 0)
 {
     global $CFG_GLPI;
     $this->check($this->getField('id'), READ);
     $canedit = $this->canSolve();
     $options = array();
     if ($knowbase_id_toload > 0) {
         $kb = new KnowbaseItem();
         if ($kb->getFromDB($knowbase_id_toload)) {
             $this->fields['solution'] = $kb->getField('answer');
         }
     }
     // Alert if validation waiting
     $validationtype = $this->getType() . 'Validation';
     if (method_exists($validationtype, 'alertValidation')) {
         $validationtype::alertValidation($this, 'solution');
     }
     $this->showFormHeader($options);
     $show_template = $canedit;
     //                        && $this->getField('solutiontypes_id') == 0
     //                        && empty($this->fields['solution']);
     $rand_template = mt_rand();
     $rand_text = $rand_type = 0;
     if ($canedit) {
         $rand_text = mt_rand();
         $rand_type = mt_rand();
     }
     if ($show_template) {
         echo "<tr class='tab_bg_2'>";
         echo "<td>" . _n('Solution template', 'Solution templates', 1) . "</td><td>";
         SolutionTemplate::dropdown(array('value' => 0, 'entity' => $this->getEntityID(), 'rand' => $rand_template, 'toupdate' => array('value_fieldname' => 'value', 'to_update' => 'solution' . $rand_text, 'url' => $CFG_GLPI["root_doc"] . "/ajax/solution.php", 'moreparams' => array('type_id' => 'dropdown_solutiontypes_id' . $rand_type))));
         echo "</td><td colspan='2'>";
         if (Session::haveRightsOr('knowbase', array(READ, KnowbaseItem::READFAQ))) {
             echo "<a class='vsubmit' title=\"" . __s('Search a solution') . "\"\n                   href='" . $CFG_GLPI['root_doc'] . "/front/knowbaseitem.php?item_itemtype=" . $this->getType() . "&amp;item_items_id=" . $this->getField('id') . "&amp;forcetab=Knowbase\$1'>" . __('Search a solution') . "</a>";
         }
         echo "</td></tr>";
     }
     echo "<tr class='tab_bg_2'>";
     echo "<td>" . __('Solution type') . "</td><td>";
     $current = $this->fields['status'];
     // Settings a solution will set status to solved
     if ($canedit) {
         SolutionType::dropdown(array('value' => $this->getField('solutiontypes_id'), 'rand' => $rand_type, 'entity' => $this->getEntityID()));
     } else {
         echo Dropdown::getDropdownName('glpi_solutiontypes', $this->getField('solutiontypes_id'));
     }
     echo "</td><td colspan='2'>&nbsp;</td></tr>";
     if ($canedit && Session::haveRight('knowbase', UPDATE)) {
         echo "<tr class='tab_bg_2'><td>" . __('Save and add to the knowledge base') . "</td><td>";
         Dropdown::showYesNo('_sol_to_kb', false);
         echo "</td><td colspan='2'>&nbsp;</td></tr>";
     }
     echo "<tr class='tab_bg_2'>";
     echo "<td>" . __('Description') . "</td><td colspan='3'>";
     if ($canedit) {
         $rand = mt_rand();
         Html::initEditorSystem("solution{$rand}");
         echo "<div id='solution{$rand_text}'>";
         echo "<textarea id='solution{$rand}' name='solution' rows='12' cols='80' class='form-control'>" . $this->getField('solution') . "</textarea></div>";
     } else {
         echo Toolbox::unclean_cross_side_scripting_deep($this->getField('solution'));
     }
     echo "</td></tr>";
     $options['candel'] = false;
     $options['canedit'] = $canedit;
     $this->showFormButtons($options);
 }

 /**
  * Execute the actions as defined in the rule
  *
  * @see Rule::executeActions()
  *
  * @param $output the result of the actions
  * @param $params the parameters
  *
  * @return the fields modified
  **/
 function executeActions($output, $params)
 {
     global $CFG_GLPI;
     $entity = '';
     $right = '';
     $is_recursive = 0;
     $continue = true;
     $output_src = $output;
     if (count($this->actions)) {
         $entity = array();
         foreach ($this->actions as $action) {
             switch ($action->fields["action_type"]) {
                 case "assign":
                     switch ($action->fields["field"]) {
                         case "entities_id":
                             $entity[] = $action->fields["value"];
                             break;
                         case "profiles_id":
                             $right = $action->fields["value"];
                             break;
                         case "is_recursive":
                             $is_recursive = $action->fields["value"];
                             break;
                         case "is_active":
                             $output["is_active"] = $action->fields["value"];
                             break;
                         case "_ignore_user_import":
                             $continue = false;
                             $output_src["_stop_import"] = true;
                             break;
                     }
                     // switch (field)
                     break;
                 case "regex_result":
                     switch ($action->fields["field"]) {
                         case "_affect_entity_by_dn":
                         case "_affect_entity_by_tag":
                         case "_affect_entity_by_domain":
                         case "_affect_entity_by_completename":
                             foreach ($this->regex_results as $regex_result) {
                                 $res = RuleAction::getRegexResultById($action->fields["value"], $regex_result);
                                 if ($res != null) {
                                     switch ($action->fields["field"]) {
                                         case "_affect_entity_by_dn":
                                             $entity_found = Entity::getEntityIDByDN(addslashes($res));
                                             break;
                                         case "_affect_entity_by_tag":
                                             $entity_found = Entity::getEntityIDByTag(addslashes($res));
                                             break;
                                         case "_affect_entity_by_domain":
                                             $entity_found = Entity::getEntityIDByDomain(addslashes($res));
                                             break;
                                         case "_affect_entity_by_completename":
                                             $res = Toolbox::unclean_cross_side_scripting_deep($res);
                                             $entity_found = Entity::getEntityIDByCompletename(addslashes($res));
                                             break;
                                         default:
                                             $entity_found = -1;
                                             break;
                                     }
                                     //If an entity was found
                                     if ($entity_found > -1) {
                                         $entity[] = $entity_found;
                                     }
                                 }
                             }
                             if (!count($entity)) {
                                 //Not entity assigned : action processing must be stopped for this rule
                                 $continue = false;
                             }
                             break;
                     }
                     // switch (field)
                     break;
             }
             // switch (action_type)
         }
         // foreach (action)
     }
     // count (actions)
     if ($continue) {
         //Nothing to be returned by the function :
         //Store in session the entity and/or right
         if (count($entity)) {
             if ($right != '') {
                 foreach ($entity as $entID) {
                     $output["_ldap_rules"]["rules_entities_rights"][] = array($entID, $right, $is_recursive);
                 }
             } else {
                 foreach ($entity as $entID) {
//.........这里部分代码省略.........

 /**
  * Populate the planning with planned reminder
  *
  * @param $options   array of possible options:
  *    - who ID of the user (0 = undefined)
  *    - who_group ID of the group of users (0 = undefined)
  *    - begin Date
  *    - end Date
  *
  * @return array of planning item
  **/
 static function populatePlanning($options = array())
 {
     global $DB, $CFG_GLPI;
     $interv = array();
     if (!isset($options['begin']) || $options['begin'] == 'NULL' || !isset($options['end']) || $options['end'] == 'NULL') {
         return $interv;
     }
     $who = $options['who'];
     $who_group = $options['who_group'];
     $begin = $options['begin'];
     $end = $options['end'];
     $readpub = $readpriv = "";
     $joinstoadd = self::addVisibilityJoins(true);
     // See public reminder ?
     if ($who === Session::getLoginUserID() && Session::haveRight("reminder_public", "r")) {
         $readpub = self::addVisibilityRestrict();
     }
     // See my private reminder ?
     if ($who_group === "mine" || $who === Session::getLoginUserID()) {
         $readpriv = "(`glpi_reminders`.`users_id` = '" . Session::getLoginUserID() . "')";
     } else {
         if ($who > 0) {
             $readpriv = "`glpi_reminders`.`users_id` = '{$who}'";
         }
         if ($who_group > 0) {
             if (!empty($readpriv)) {
                 $readpriv .= " OR ";
             }
             $readpriv .= " `glpi_groups_reminders`.`groups_id` = '{$who_group}'";
         }
         if (!empty($readpriv)) {
             $readpriv = '(' . $readpriv . ')';
         }
     }
     $ASSIGN = '';
     if (!empty($readpub) && !empty($readpriv)) {
         $ASSIGN = "({$readpub} OR {$readpriv})";
     } else {
         if ($readpub) {
             $ASSIGN = $readpub;
         } else {
             $ASSIGN = $readpriv;
         }
     }
     if ($ASSIGN) {
         $query2 = "SELECT DISTINCT `glpi_reminders`.*\n                    FROM `glpi_reminders`\n                    {$joinstoadd}\n                    WHERE `glpi_reminders`.`is_planned` = '1'\n                          AND {$ASSIGN}\n                          AND `begin` < '{$end}'\n                          AND `end` > '{$begin}'\n                    ORDER BY `begin`";
         $result2 = $DB->query($query2);
         if ($DB->numrows($result2) > 0) {
             for ($i = 0; $data = $DB->fetch_assoc($result2); $i++) {
                 $key = $data["begin"] . "\$\$" . $i;
                 $interv[$key]["itemtype"] = 'Reminder';
                 $interv[$key]["reminders_id"] = $data["id"];
                 $interv[$key]["id"] = $data["id"];
                 if (strcmp($begin, $data["begin"]) > 0) {
                     $interv[$key]["begin"] = $begin;
                 } else {
                     $interv[$key]["begin"] = $data["begin"];
                 }
                 if (strcmp($end, $data["end"]) < 0) {
                     $interv[$key]["end"] = $end;
                 } else {
                     $interv[$key]["end"] = $data["end"];
                 }
                 $interv[$key]["name"] = Html::resume_text($data["name"], $CFG_GLPI["cut"]);
                 $interv[$key]["text"] = Html::resume_text(Html::clean(Toolbox::unclean_cross_side_scripting_deep($data["text"])), $CFG_GLPI["cut"]);
                 $interv[$key]["users_id"] = $data["users_id"];
                 $interv[$key]["state"] = $data["state"];
                 $interv[$key]["state"] = $data["state"];
             }
         }
     }
     return $interv;
 }

 /**
  * Get dn for a user
  *
  * @param $ds              LDAP link
  * @param $options   array of possible options:
  *          - basedn : base dn used to search
  *          - login_field : attribute to store login
  *          - search_parameters array of search parameters
  *          - user_params  array of parameters : method (IDENTIFIER_LOGIN or IDENTIFIER_EMAIL) + value
  *          - condition : ldap condition used
  *
  * @return dn of the user, else false
  **/
 static function searchUserDn($ds, $options = array())
 {
     $values['basedn'] = '';
     $values['login_field'] = '';
     $values['search_parameters'] = array();
     $values['user_params'] = '';
     $values['condition'] = '';
     $values['user_dn'] = false;
     foreach ($options as $key => $value) {
         $values[$key] = $value;
     }
     //By default authentify users by login
     //$authentification_value = '';
     $login_attr = $values['search_parameters']['fields'][self::IDENTIFIER_LOGIN];
     $ldap_parameters = array("dn");
     foreach ($values['search_parameters']['fields'] as $parameter) {
         $ldap_parameters[] = $parameter;
     }
     //First : if a user dn is provided, look for it in the directory
     //Before trying to find the user using his login_field
     if ($values['user_dn']) {
         $info = self::getUserByDn($ds, $values['user_dn'], $ldap_parameters);
         if ($info) {
             return array('dn' => $values['user_dn'], $login_attr => $info[$login_attr][0]);
         }
     }
     //$authentification_value = $values['user_params']['value'];
     // Tenter une recherche pour essayer de retrouver le DN
     $filter = "(" . $values['login_field'] . "=" . $values['user_params']['value'] . ")";
     if (!empty($values['condition'])) {
         $filter = "(& {$filter} " . $values['condition'] . ")";
     }
     $filter = Toolbox::unclean_cross_side_scripting_deep($filter);
     if ($result = @ldap_search($ds, $values['basedn'], $filter, $ldap_parameters)) {
         $info = self::get_entries_clean($ds, $result);
         if (is_array($info) && $info['count'] == 1) {
             return array('dn' => $info[0]['dn'], $login_attr => $info[0][$login_attr][0]);
         }
     }
     return false;
 }

 /**
  * @param $input  array
  */
 static function cleanContentHtml(array $input)
 {
     $txt = Html::clean(Toolbox::unclean_cross_side_scripting_deep($input['content_html']));
     $txt = trim(html_entity_decode($txt, 0, 'UTF-8'));
     if (!$txt) {
         // No HTML (nothing to display)
         $input['content_html'] = '';
     } else {
         if (!$input['content_text']) {
             // Use cleaned HTML
             $input['content_text'] = $txt;
         }
     }
     return $input;
 }

//.........这里部分代码省略.........
             // Pager
             $parameters = "start=" . $params["start"] . "&knowbaseitemcategories_id=" . $params['knowbaseitemcategories_id'] . "&contains=" . $params["contains"] . "&is_faq=" . $params['faq'];
             if (isset($options['item_itemtype']) && isset($options['item_items_id'])) {
                 $parameters .= "&item_items_id=" . $options['item_items_id'] . "&item_itemtype=" . $options['item_itemtype'];
             }
             if ($output_type == Search::HTML_OUTPUT) {
                 Html::printPager($params['start'], $numrows, Toolbox::getItemTypeSearchURL('KnowbaseItem'), $parameters, 'KnowbaseItem');
             }
             $nbcols = 1;
             // Display List Header
             echo Search::showHeader($output_type, $numrows_limit + 1, $nbcols);
             echo Search::showNewLine($output_type);
             $header_num = 1;
             echo Search::showHeaderItem($output_type, __('Subject'), $header_num);
             if ($output_type != Search::HTML_OUTPUT) {
                 echo Search::showHeaderItem($output_type, __('Content'), $header_num);
             }
             if ($showwriter) {
                 echo Search::showHeaderItem($output_type, __('Writer'), $header_num);
             }
             echo Search::showHeaderItem($output_type, __('Category'), $header_num);
             if (isset($options['item_itemtype']) && isset($options['item_items_id']) && $output_type == Search::HTML_OUTPUT) {
                 echo Search::showHeaderItem($output_type, ' ', $header_num);
             }
             // Num of the row (1=header_line)
             $row_num = 1;
             for ($i = 0; $i < $numrows_limit; $i++) {
                 $data = $DB->fetch_assoc($result_limit);
                 Session::addToNavigateListItems('KnowbaseItem', $data["id"]);
                 // Column num
                 $item_num = 1;
                 $row_num++;
                 echo Search::showNewLine($output_type, $i % 2);
                 $item = new self();
                 $item->getFromDB($data["id"]);
                 $name = $data["name"];
                 $answer = $data["answer"];
                 // Manage translations
                 if (isset($data['transname']) && !empty($data['transname'])) {
                     $name = $data["transname"];
                 }
                 if (isset($data['transanswer']) && !empty($data['transanswer'])) {
                     $answer = $data["transanswer"];
                 }
                 if ($output_type == Search::HTML_OUTPUT) {
                     $toadd = '';
                     if (isset($options['item_itemtype']) && isset($options['item_items_id'])) {
                         $href = " href='#' onClick=\"" . Html::jsGetElementbyID('kbshow' . $data["id"]) . ".dialog('open');\"";
                         $toadd = Ajax::createIframeModalWindow('kbshow' . $data["id"], $CFG_GLPI["root_doc"] . "/front/knowbaseitem.form.php?id=" . $data["id"], array('display' => false));
                     } else {
                         $href = " href=\"" . $CFG_GLPI['root_doc'] . "/front/knowbaseitem.form.php?id=" . $data["id"] . "\" ";
                     }
                     echo Search::showItem($output_type, "<div class='kb'>{$toadd}<a " . ($data['is_faq'] ? " class='pubfaq' title='" . __("This item is part of the FAQ") . "' " : " class='knowbase' ") . " {$href}>" . Html::resume_text($name, 80) . "</a></div>\n                                          <div class='kb_resume'>" . Html::resume_text(Html::clean(Toolbox::unclean_cross_side_scripting_deep($answer)), 600) . "</div>", $item_num, $row_num);
                 } else {
                     echo Search::showItem($output_type, $name, $item_num, $row_num);
                     echo Search::showItem($output_type, Html::clean(Toolbox::unclean_cross_side_scripting_deep(html_entity_decode($answer, ENT_QUOTES, "UTF-8"))), $item_num, $row_num);
                 }
                 $showuserlink = 0;
                 if (Session::haveRight('user', READ)) {
                     $showuserlink = 1;
                 }
                 if ($showwriter) {
                     echo Search::showItem($output_type, getUserName($data["users_id"], $showuserlink), $item_num, $row_num);
                 }
                 $categ = $data["category"];
                 if ($output_type == Search::HTML_OUTPUT) {
                     $cathref = $ki->getSearchURL() . "?knowbaseitemcategories_id=" . $data["knowbaseitemcategories_id"] . '&amp;forcetab=Knowbase$2';
                     $categ = "<a href='{$cathref}'>" . $categ . '</a>';
                 }
                 echo Search::showItem($output_type, $categ, $item_num, $row_num);
                 if (isset($options['item_itemtype']) && isset($options['item_items_id']) && $output_type == Search::HTML_OUTPUT) {
                     $forcetab = $options['item_itemtype'];
                     if (!$_SESSION['glpiticket_timeline'] || $_SESSION['glpiticket_timeline_keep_replaced_tabs']) {
                         $forcetab .= '$2';
                         //Solution tab
                     } else {
                         $forcetab .= '$1';
                         //Timeline tab
                     }
                     $content = "<a href='" . Toolbox::getItemTypeFormURL($options['item_itemtype']) . "?load_kb_sol=" . $data['id'] . "&amp;id=" . $options['item_items_id'] . "&amp;forcetab=" . $forcetab . "'>" . __('Use as a solution') . "</a>";
                     echo Search::showItem($output_type, $content, $item_num, $row_num);
                 }
                 // End Line
                 echo Search::showEndLine($output_type);
             }
             // Display footer
             if ($output_type == Search::PDF_OUTPUT_LANDSCAPE || $output_type == Search::PDF_OUTPUT_PORTRAIT) {
                 echo Search::showFooter($output_type, Dropdown::getDropdownName("glpi_knowbaseitemcategories", $params['knowbaseitemcategories_id']));
             } else {
                 echo Search::showFooter($output_type);
             }
             echo "<br>";
             if ($output_type == Search::HTML_OUTPUT) {
                 Html::printPager($params['start'], $numrows, Toolbox::getItemTypeSearchURL('KnowbaseItem'), $parameters, 'KnowbaseItem');
             }
         } else {
             echo "<div class='center b'>" . __('No item found') . "</div>";
         }
     }
 }

 function prepareInputForUpdate($input)
 {
     global $CFG_GLPI;
     if (isset($input["password2"])) {
         // Empty : do not update
         if (empty($input["password"])) {
             unset($input["password"]);
         } else {
             if ($input["password"] == $input["password2"]) {
                 // Check right : my password of user with lesser rights
                 if (isset($input['id']) && Config::validatePassword($input["password"]) && ($input['id'] == Session::getLoginUserID() || $this->currentUserHaveMoreRightThan($input['id']) || $input['password_forget_token'] == $this->fields['password_forget_token'] && abs(strtotime($_SESSION["glpi_currenttime"]) - strtotime($this->fields['password_forget_token_date'])) < DAY_TIMESTAMP && $this->isEmail($input['email']))) {
                     $input["password"] = sha1(Toolbox::unclean_cross_side_scripting_deep(stripslashes($input["password"])));
                 } else {
                     unset($input["password"]);
                 }
                 unset($input["password2"]);
             } else {
                 Session::addMessageAfterRedirect(__('Error: the two passwords do not match'), false, ERROR);
                 return false;
             }
         }
     } else {
         if (isset($input["password"])) {
             // From login
             unset($input["password"]);
         }
     }
     // Update User in the database
     if (!isset($input["id"]) && isset($input["name"])) {
         if ($this->getFromDBbyName($input["name"])) {
             $input["id"] = $this->fields["id"];
         }
     }
     if (isset($input["entities_id"]) && Session::getLoginUserID() === $input['id']) {
         $_SESSION["glpidefault_entity"] = $input["entities_id"];
     }
     // Security on default profile update
     if (isset($input['profiles_id'])) {
         if (!in_array($input['profiles_id'], Profile_User::getUserProfiles($input['id']))) {
             unset($input['profiles_id']);
         }
     }
     // Security on default entity  update
     if (isset($input['entities_id'])) {
         if (!in_array($input['entities_id'], Profile_User::getUserEntities($input['id']))) {
             unset($input['entities_id']);
         }
     }
     if (isset($input['_reset_personal_token'])) {
         $input['personal_token'] = self::getUniquePersonalToken();
         $input['personal_token_date'] = $_SESSION['glpi_currenttime'];
     }
     // Manage preferences fields
     if (Session::getLoginUserID() === $input['id']) {
         if (isset($input['use_mode']) && $_SESSION['glpi_use_mode'] != $input['use_mode']) {
             $_SESSION['glpi_use_mode'] = $input['use_mode'];
             //Session::loadLanguage();
         }
     }
     foreach ($CFG_GLPI['user_pref_field'] as $f) {
         if (isset($input[$f])) {
             if (Session::getLoginUserID() === $input['id']) {
                 if ($_SESSION["glpi{$f}"] != $input[$f]) {
                     $_SESSION["glpi{$f}"] = $input[$f];
                 }
             }
             if ($input[$f] == $CFG_GLPI[$f]) {
                 $input[$f] = "NULL";
             }
         }
     }
     return $input;
 }

 /**
  * Populate the planning with planned reminder
  *
  * @param $options   array of possible options:
  *    - who ID of the user (0 = undefined)
  *    - who_group ID of the group of users (0 = undefined)
  *    - begin Date
  *    - end Date
  *    - color
  *    - event_type_color
  *    - check_avaibility (boolean)
  *
  * @return array of planning item
  **/
 static function populatePlanning($options = array())
 {
     global $DB, $CFG_GLPI;
     $default_options = array('color' => '', 'event_type_color' => '', 'check_planned' => false);
     $options = array_merge($default_options, $options);
     $interv = array();
     $reminder = new self();
     if (!isset($options['begin']) || $options['begin'] == 'NULL' || !isset($options['end']) || $options['end'] == 'NULL') {
         return $interv;
     }
     $who = $options['who'];
     $who_group = $options['who_group'];
     $begin = $options['begin'];
     $end = $options['end'];
     $readpub = $readpriv = "";
     $joinstoadd = self::addVisibilityJoins(true);
     // See public reminder ?
     if ($who === Session::getLoginUserID() && self::canView()) {
         $readpub = self::addVisibilityRestrict();
     }
     // See my private reminder ?
     if ($who_group === "mine" || $who === Session::getLoginUserID()) {
         $readpriv = "(`glpi_reminders`.`users_id` = '" . Session::getLoginUserID() . "')";
     } else {
         if ($who > 0) {
             $readpriv = "`glpi_reminders`.`users_id` = '{$who}'";
         }
         if ($who_group > 0) {
             if (!empty($readpriv)) {
                 $readpriv .= " OR ";
             }
             $readpriv .= " `glpi_groups_reminders`.`groups_id` = '{$who_group}'";
         }
         if (!empty($readpriv)) {
             $readpriv = '(' . $readpriv . ')';
         }
     }
     $ASSIGN = '';
     if (!empty($readpub) && !empty($readpriv)) {
         $ASSIGN = "({$readpub} OR {$readpriv})";
     } else {
         if ($readpub) {
             $ASSIGN = $readpub;
         } else {
             $ASSIGN = $readpriv;
         }
     }
     $PLANNED = '';
     if ($options['check_planned']) {
         $PLANNED = "AND state != " . Planning::INFO;
     }
     if ($ASSIGN) {
         $query2 = "SELECT DISTINCT `glpi_reminders`.*\n                    FROM `glpi_reminders`\n                    {$joinstoadd}\n                    WHERE `glpi_reminders`.`is_planned` = '1'\n                          AND {$ASSIGN}\n                          {$PLANNED}\n                          AND `begin` < '{$end}'\n                          AND `end` > '{$begin}'\n                    ORDER BY `begin`";
         $result2 = $DB->query($query2);
         if ($DB->numrows($result2) > 0) {
             for ($i = 0; $data = $DB->fetch_assoc($result2); $i++) {
                 $key = $data["begin"] . "\$\$" . "Reminder" . "\$\$" . $data["id"];
                 $interv[$key]['color'] = $options['color'];
                 $interv[$key]['event_type_color'] = $options['event_type_color'];
                 $interv[$key]["itemtype"] = 'Reminder';
                 $interv[$key]["reminders_id"] = $data["id"];
                 $interv[$key]["id"] = $data["id"];
                 if (strcmp($begin, $data["begin"]) > 0) {
                     $interv[$key]["begin"] = $begin;
                 } else {
                     $interv[$key]["begin"] = $data["begin"];
                 }
                 if (strcmp($end, $data["end"]) < 0) {
                     $interv[$key]["end"] = $end;
                 } else {
                     $interv[$key]["end"] = $data["end"];
                 }
                 $interv[$key]["name"] = Html::resume_text($data["name"], $CFG_GLPI["cut"]);
                 $interv[$key]["text"] = Html::resume_text(Html::clean(Toolbox::unclean_cross_side_scripting_deep($data["text"])), $CFG_GLPI["cut"]);
                 $interv[$key]["users_id"] = $data["users_id"];
                 $interv[$key]["state"] = $data["state"];
                 $interv[$key]["state"] = $data["state"];
                 $interv[$key]["url"] = $CFG_GLPI["root_doc"] . "/front/reminder.form.php?id=" . $data['id'];
                 $interv[$key]["ajaxurl"] = $CFG_GLPI["root_doc"] . "/ajax/planning.php" . "?action=edit_event_form" . "&itemtype=Reminder" . "&id=" . $data['id'] . "&url=" . $interv[$key]["url"];
                 $reminder->getFromDB($data["id"]);
                 $interv[$key]["editable"] = $reminder->canUpdateItem();
             }
         }
     }
     return $interv;
 }

//.........这里部分代码省略.........
     $params['on_change'] = '';
     $params['condition'] = '';
     $params['rand'] = mt_rand();
     $params['displaywith'] = array();
     //Parameters about choice 0
     //Empty choice's label
     $params['emptylabel'] = self::EMPTY_VALUE;
     //Display emptychoice ?
     $params['display_emptychoice'] = $itemtype != 'Entity';
     $params['display'] = true;
     $params['permit_select_parent'] = false;
     $params['addicon'] = true;
     $params['specific_tags'] = array();
     $params['url'] = $CFG_GLPI['root_doc'] . "/ajax/getDropdownValue.php";
     if (is_array($options) && count($options)) {
         foreach ($options as $key => $val) {
             $params[$key] = $val;
         }
     }
     $output = '';
     $name = $params['emptylabel'];
     $comment = "";
     // Check default value for dropdown : need to be a numeric
     if (strlen($params['value']) == 0 || !is_numeric($params['value']) && $params['value'] != 'mygroups') {
         $params['value'] = 0;
     }
     if (isset($params['toadd'][$params['value']])) {
         $name = $params['toadd'][$params['value']];
     } else {
         if ($params['value'] > 0 || $itemtype == "Entity" && $params['value'] >= 0) {
             $tmpname = self::getDropdownName($table, $params['value'], 1);
             if ($tmpname["name"] != " ") {
                 $name = $tmpname["name"];
                 $comment = $tmpname["comment"];
             }
         }
     }
     // Manage entity_sons
     if (!($params['entity'] < 0) && $params['entity_sons']) {
         if (is_array($params['entity'])) {
             // translation not needed - only for debug
             $output .= "entity_sons options is not available with entity option as array";
         } else {
             $params['entity'] = getSonsOf('glpi_entities', $params['entity']);
         }
     }
     $field_id = Html::cleanId("dropdown_" . $params['name'] . $params['rand']);
     // Manage condition
     if (!empty($params['condition'])) {
         $params['condition'] = static::addNewCondition($params['condition']);
     }
     if (!$item instanceof CommonTreeDropdown) {
         $name = Toolbox::unclean_cross_side_scripting_deep($name);
     }
     $p = array('value' => $params['value'], 'valuename' => $name, 'width' => $params['width'], 'itemtype' => $itemtype, 'display_emptychoice' => $params['display_emptychoice'], 'displaywith' => $params['displaywith'], 'emptylabel' => $params['emptylabel'], 'condition' => $params['condition'], 'used' => $params['used'], 'toadd' => $params['toadd'], 'entity_restrict' => is_array($params['entity']) ? json_encode(array_values($params['entity'])) : $params['entity'], 'on_change' => $params['on_change'], 'permit_select_parent' => $params['permit_select_parent'], 'specific_tags' => $params['specific_tags']);
     $output = "<span class='no-wrap'>";
     $output .= Html::jsAjaxDropdown($params['name'], $field_id, $params['url'], $p);
     // Display comment
     if ($params['comments']) {
         $comment_id = Html::cleanId("comment_" . $params['name'] . $params['rand']);
         $link_id = Html::cleanId("comment_link_" . $params['name'] . $params['rand']);
         $options_tooltip = array('contentid' => $comment_id, 'linkid' => $link_id, 'display' => false);
         if ($item->canView()) {
             if ($params['value'] && $item->getFromDB($params['value']) && $item->canViewItem()) {
                 $options_tooltip['link'] = $item->getLinkURL();
             } else {
                 $options_tooltip['link'] = $item->getSearchURL();
             }
             $options_tooltip['linktarget'] = '_blank';
         }
         $output .= "&nbsp;" . Html::showToolTip($comment, $options_tooltip);
         if ($item instanceof CommonDropdown && $item->canCreate() && !isset($_REQUEST['_in_modal']) && $params['addicon']) {
             $output .= "<img alt='' title=\"" . __s('Add') . "\" src='" . $CFG_GLPI["root_doc"] . "/pics/add_dropdown.png' style='cursor:pointer; margin-left:2px;'\n                            onClick=\"" . Html::jsGetElementbyID('add_dropdown' . $params['rand']) . ".dialog('open');\">";
             $output .= Ajax::createIframeModalWindow('add_dropdown' . $params['rand'], $item->getFormURL(), array('display' => false));
         }
         // Display specific Links
         if ($itemtype == "Supplier") {
             if ($item->getFromDB($params['value'])) {
                 $output .= $item->getLinks();
             }
         }
         if ($itemtype == 'ITILCategory' && Session::haveRight('knowbase', READ)) {
             if ($params['value'] && $item->getFromDB($params['value'])) {
                 $output .= '&nbsp;' . $item->getLinks();
             }
         }
         $paramscomment = array('value' => '__VALUE__', 'table' => $table);
         if ($item->canView()) {
             $paramscomment['withlink'] = $link_id;
         }
         $output .= Ajax::updateItemOnSelectEvent($field_id, $comment_id, $CFG_GLPI["root_doc"] . "/ajax/comments.php", $paramscomment, false);
     }
     $output .= Ajax::commonDropdownUpdateItem($params, false);
     if ($params['display']) {
         echo $output;
         return $params['rand'];
     }
     $output .= "</span>";
     return $output;
 }

//.........这里部分代码省略.........
     if (isset($params['order'])) {
         if (is_array($params['order'])) {
             $tab = $params['order'];
         } else {
             $tab = array($params['order'] => 'DESC');
         }
         foreach ($tab as $key => $val) {
             if ($val != 'ASC') {
                 $val = 'DESC';
             }
             $sqlkey = array('id' => '`glpi_tickets`.`id`', 'date' => '`glpi_tickets`.`date`', 'closedate' => '`glpi_tickets`.`closedate`', 'date_mod' => '`glpi_tickets`.`date_mod`', 'status' => '`glpi_tickets`.`status`', 'entities_id' => '`glpi_tickets`.`entities_id`', 'priority' => '`glpi_tickets`.`priority`');
             if (isset($sqlkey[$key])) {
                 $orders[] = $sqlkey[$key] . " {$val}";
             } else {
                 return self::Error($protocol, WEBSERVICES_ERROR_BADPARAMETER, '', 'order=$key');
             }
         }
     }
     if (count($orders)) {
         $order = implode(',', $orders);
     } else {
         $order = "`glpi_tickets`.`date_mod` DESC";
     }
     $resp = array();
     if (isset($params['count'])) {
         $query = "SELECT COUNT(DISTINCT `glpi_tickets`.`id`) AS count\n                   FROM `glpi_tickets`\n                   {$join}\n                   LEFT JOIN `glpi_tickets_users` AS glpi_tickets_users_request\n                        ON (`glpi_tickets`.`id` = `glpi_tickets_users_request`.`tickets_id`\n                            AND `glpi_tickets_users_request`.`type` = 1)\n                   LEFT JOIN `glpi_groups_tickets` AS glpi_groups_tickets_request\n                        ON (`glpi_tickets`.`id` = `glpi_groups_tickets_request`.`tickets_id`\n                            AND `glpi_groups_tickets_request`.`type` = 1 )\n                   {$where}";
         $resp = $DB->request($query)->next();
         //debug $resp['query'] = $query;
     } else {
         $query = "SELECT `glpi_tickets`.*,\n                          GROUP_CONCAT(DISTINCT `glpi_tickets_users_request`.`users_id` SEPARATOR ',')\n                                 AS users_id_request,\n                          GROUP_CONCAT(DISTINCT `glpi_tickets_users_observer`.`users_id` SEPARATOR ',')\n                                 AS users_id_observer,\n                          GROUP_CONCAT(DISTINCT `glpi_tickets_users_assign`.`users_id` SEPARATOR ',')\n                                 AS users_id_assign,\n                          GROUP_CONCAT(DISTINCT `glpi_groups_tickets_request`.`groups_id` SEPARATOR ',')\n                                 AS groups_id_request,\n                          GROUP_CONCAT(DISTINCT `glpi_groups_tickets_observer`.`groups_id` SEPARATOR ',')\n                                 AS groups_id_observer,\n                          GROUP_CONCAT(DISTINCT `glpi_groups_tickets_assign`.`groups_id` SEPARATOR ',')\n                                 AS groups_id_assign\n                   FROM `glpi_tickets`\n                   {$join}\n                   LEFT JOIN `glpi_tickets_users` AS glpi_tickets_users_request\n                        ON (`glpi_tickets`.`id` = `glpi_tickets_users_request`.`tickets_id`\n                            AND `glpi_tickets_users_request`.`type` = 1)\n                   LEFT JOIN `glpi_tickets_users` AS glpi_tickets_users_assign\n                        ON (`glpi_tickets`.`id` = `glpi_tickets_users_assign`.`tickets_id`\n                            AND `glpi_tickets_users_assign`.`type` = 2)\n                   LEFT JOIN `glpi_tickets_users` AS glpi_tickets_users_observer\n                        ON (`glpi_tickets`.`id` = `glpi_tickets_users_observer`.`tickets_id`\n                            AND `glpi_tickets_users_observer`.`type` = 3)\n                   LEFT JOIN `glpi_groups_tickets` AS glpi_groups_tickets_request\n                        ON (`glpi_tickets`.`id` = `glpi_groups_tickets_request`.`tickets_id`\n                            AND `glpi_groups_tickets_request`.`type` = 1)\n                   LEFT JOIN `glpi_groups_tickets` AS glpi_groups_tickets_assign\n                        ON (`glpi_tickets`.`id` = `glpi_groups_tickets_assign`.`tickets_id`\n                            AND `glpi_groups_tickets_assign`.`type` = 2)\n                   LEFT JOIN `glpi_groups_tickets` AS glpi_groups_tickets_observer\n                        ON (`glpi_tickets`.`id` = `glpi_groups_tickets_observer`.`tickets_id`\n                            AND `glpi_groups_tickets_observer`.`type` = 3)\n                   {$where}\n                   GROUP BY `glpi_tickets`.`id`\n                   ORDER BY {$order}\n                   LIMIT {$start},{$limit}";
         foreach ($DB->request($query) as $data) {
             $tmp = explode(',', $data['users_id_request']);
             $data['users']['requester'] = array();
             foreach ($tmp as $id) {
                 $data['users']['requester'][]['id'] = $id;
             }
             $tmp = explode(',', $data['users_id_observer']);
             $data['users']['observer'] = array();
             foreach ($tmp as $id) {
                 $data['users']['observer'][]['id'] = $id;
             }
             $tmp = explode(',', $data['users_id_assign']);
             $data['users']['assign'] = array();
             foreach ($tmp as $id) {
                 $data['users']['assign'][]['id'] = $id;
             }
             $tmp = explode(',', $data['groups_id_request']);
             $data['groups']['requester'] = array();
             foreach ($tmp as $id) {
                 $data['groups']['requester'][]['id'] = $id;
             }
             $tmp = explode(',', $data['groups_id_observer']);
             $data['groups']['observer'] = array();
             foreach ($tmp as $id) {
                 $data['groups']['observer'][]['id'] = $id;
             }
             $tmp = explode(',', $data['groups_id_assign']);
             $data['groups']['assign'] = array();
             foreach ($tmp as $id) {
                 $data['groups']['assign'][]['id'] = $id;
             }
             unset($data['groups_id_request'], $data['groups_id_observer'], $data['groups_id_assign'], $data['users_id_request'], $data['users_id_observer'], $data['users_id_assign']);
             $data['solution'] = Html::clean(Toolbox::unclean_cross_side_scripting_deep($data['solution']));
             if (isset($params['id2name'])) {
                 if ($data['itemtype'] && ($item = getItemForItemtype($data['itemtype']))) {
                     $data['itemtype_name'] = Html::clean($item->getTypeName());
                     if ($item->getFromDB($data['items_id'])) {
                         $data['items_name'] = Html::clean($item->getNameID());
                     } else {
                         $data['items_name'] = NOT_AVAILABLE;
                     }
                 }
                 foreach ($data['groups'] as $type => $tab) {
                     foreach ($tab as $key => $grp) {
                         $data['groups'][$type][$key]['name'] = Html::clean(Dropdown::getDropdownName('glpi_groups', $grp['id']));
                     }
                 }
                 foreach ($data['users'] as $type => $tab) {
                     foreach ($tab as $key => $usr) {
                         $data['users'][$type][$key]['name'] = Html::clean(getUserName($usr['id']));
                     }
                 }
                 $data['status_name'] = Html::clean(Ticket::getStatus($data['status']));
                 $data['urgency_name'] = Ticket::getUrgencyName($data['urgency']);
                 $data['impact_name'] = Ticket::getImpactName($data['impact']);
                 $data['priority_name'] = Ticket::getPriorityName($data['priority']);
                 $data['users_name_recipient'] = Html::clean(getUserName($data['users_id_recipient']));
                 $data['entities_name'] = Html::clean(Dropdown::getDropdownName('glpi_entities', $data['entities_id']));
                 $data['suppliers_name_assign'] = Html::clean(Dropdown::getDropdownName('glpi_suppliers', $data['suppliers_id_assign']));
                 $data['ticketcategories_name'] = Html::clean(Dropdown::getDropdownName('glpi_itilcategories', $data['itilcategories_id']));
                 $data['requesttypes_name'] = Html::clean(Dropdown::getDropdownName('glpi_requesttypes', $data['requesttypes_id']));
                 $data['solutiontypes_name'] = Html::clean(Dropdown::getDropdownName('glpi_solutiontypes', $data['solutiontypes_id']));
                 $data['slas_name'] = Html::clean(Dropdown::getDropdownName('glpi_slas', $data['slas_id']));
                 $data['slalevels_name'] = Html::clean(Dropdown::getDropdownName('glpi_slalevels', $data['slalevels_id']));
             }
             $resp[] = $data;
         }
     }
     return $resp;
 }

 /**
  * @param $ID
  * @param $forcetab  string   name of the tab to force at the display (default '')
  **/
 static function showVeryShort($ID, $forcetab = '')
 {
     global $CFG_GLPI;
     // Prints a job in short form
     // Should be called in a <table>-segment
     // Print links or not in case of user view
     // Make new job object and fill it from database, if success, print it
     $showprivate = false;
     if (Session::haveRight('followup', TicketFollowup::SEEPRIVATE)) {
         $showprivate = true;
     }
     $job = new self();
     $rand = mt_rand();
     if ($job->getFromDBwithData($ID, 0)) {
         $bgcolor = $_SESSION["glpipriority_" . $job->fields["priority"]];
         //      $rand    = mt_rand();
         echo "<tr class='tab_bg_2'>";
         echo "<td class='center' bgcolor='{$bgcolor}'>" . sprintf(__('%1$s: %2$s'), __('ID'), $job->fields["id"]) . "</td>";
         echo "<td class='center'>";
         if (isset($job->users[CommonITILActor::REQUESTER]) && count($job->users[CommonITILActor::REQUESTER])) {
             foreach ($job->users[CommonITILActor::REQUESTER] as $d) {
                 if ($d["users_id"] > 0) {
                     $userdata = getUserName($d["users_id"], 2);
                     $name = "<span class='b'>" . $userdata['name'] . "</span>";
                     $name = sprintf(__('%1$s %2$s'), $name, Html::showToolTip($userdata["comment"], array('link' => $userdata["link"], 'display' => false)));
                     echo $name;
                 } else {
                     echo $d['alternative_email'] . "&nbsp;";
                 }
                 echo "<br>";
             }
         }
         if (isset($job->groups[CommonITILActor::REQUESTER]) && count($job->groups[CommonITILActor::REQUESTER])) {
             foreach ($job->groups[CommonITILActor::REQUESTER] as $d) {
                 echo Dropdown::getDropdownName("glpi_groups", $d["groups_id"]);
                 echo "<br>";
             }
         }
         echo "</td>";
         echo "<td class='center'>";
         if (!empty($job->hardwaredatas)) {
             foreach ($job->hardwaredatas as $hardwaredatas) {
                 if ($hardwaredatas->canView()) {
                     echo $hardwaredatas->getTypeName() . " - ";
                     echo "<span class='b'>" . $hardwaredatas->getLink() . "</span><br/>";
                 } else {
                     if ($hardwaredatas) {
                         echo $hardwaredatas->getTypeName() . " - ";
                         echo "<span class='b'>" . $hardwaredatas->getNameID() . "</span><br/>";
                     }
                 }
             }
         } else {
             echo __('General');
         }
         echo "<td>";
         $link = "<a id='ticket" . $job->fields["id"] . $rand . "' href='" . $CFG_GLPI["root_doc"] . "/front/ticket.form.php?id=" . $job->fields["id"];
         if ($forcetab != '') {
             $link .= "&amp;forcetab=" . $forcetab;
         }
         $link .= "'>";
         $link .= "<span class='b'>" . $job->getNameID() . "</span></a>";
         $link = sprintf(__('%1$s (%2$s)'), $link, sprintf(__('%1$s - %2$s'), $job->numberOfFollowups($showprivate), $job->numberOfTasks($showprivate)));
         $content = Toolbox::unclean_cross_side_scripting_deep(html_entity_decode($job->fields['content'], ENT_QUOTES, "UTF-8"));
         $link = printf(__('%1$s %2$s'), $link, Html::showToolTip(nl2br(Html::Clean($content)), array('applyto' => 'ticket' . $job->fields["id"] . $rand, 'display' => false)));
         echo "</td>";
         // Finish Line
         echo "</tr>";
     } else {
         echo "<tr class='tab_bg_2'>";
         echo "<td colspan='6' ><i>" . __('No ticket in progress.') . "</i></td></tr>";
     }
 }

    if (!is_writable(GLPI_SESSION_DIR)) {
        Html::redirect($CFG_GLPI['root_doc'] . "/index.php?error=2");
    } else {
        Html::redirect($CFG_GLPI['root_doc'] . "/index.php?error=1");
    }
}
$_POST = array_map('stripslashes', $_POST);
//Do login and checks
//$user_present = 1;
if (isset($_SESSION['namfield']) && isset($_POST[$_SESSION['namfield']])) {
    $login = $_POST[$_SESSION['namfield']];
} else {
    $login = '';
}
if (isset($_SESSION['pwdfield']) && isset($_POST[$_SESSION['pwdfield']])) {
    $password = Toolbox::unclean_cross_side_scripting_deep($_POST[$_SESSION['pwdfield']]);
} else {
    $password = '';
}
// Redirect management
$REDIRECT = "";
if (isset($_POST['redirect']) && strlen($_POST['redirect']) > 0) {
    $REDIRECT = "?redirect=" . rawurlencode($_POST['redirect']);
} else {
    if (isset($_GET['redirect']) && strlen($_GET['redirect']) > 0) {
        $REDIRECT = "?redirect=" . rawurlencode($_GET['redirect']);
    }
}
$auth = new Auth();
// now we can continue with the process...
if ($auth->Login($login, $password, isset($_REQUEST["noAUTO"]) ? $_REQUEST["noAUTO"] : false)) {

 }
 if (isset($data['transname']) && !empty($data['transname'])) {
     $outputval = $data['transname'];
 } else {
     if ($field == 'itemtype' && class_exists($data['itemtype'])) {
         $tmpitem = new $data[$field]();
         if ($tmpitem->getFromDB($data['items_id'])) {
             $outputval = sprintf(__('%1$s - %2$s'), $tmpitem->getTypeName(), $tmpitem->getName());
         } else {
             $outputval = $tmpitem->getTypeName();
         }
     } else {
         $outputval = $data[$field];
     }
 }
 $outputval = Toolbox::unclean_cross_side_scripting_deep($outputval);
 if ($displaywith) {
     foreach ($_POST['displaywith'] as $key) {
         if (isset($data[$key])) {
             $withoutput = $data[$key];
             if (isForeignKeyField($key)) {
                 $withoutput = Dropdown::getDropdownName(getTableNameForForeignKeyField($key), $data[$key]);
             }
             if (strlen($withoutput) > 0 && $withoutput != ' ') {
                 $outputval = sprintf(__('%1$s - %2$s'), $outputval, $withoutput);
             }
         }
     }
 }
 $ID = $data['id'];
 $addcomment = "";