PHP module_form::check_secure_key方法代碼示例

 public static function bulk_handle_delete()
 {
     if (isset($_REQUEST['bulk_action']) && isset($_REQUEST['bulk_action']['delete']) && $_REQUEST['bulk_action']['delete'] == 'yes' && module_form::check_secure_key() && module_invoice::can_i('delete', 'Invoices')) {
         // confirm deletion of these tickets:
         $invoice_ids = isset($_REQUEST['invoice_bulk_operation']) && is_array($_REQUEST['invoice_bulk_operation']) ? $_REQUEST['invoice_bulk_operation'] : array();
         foreach ($invoice_ids as $invoice_id => $k) {
             if ($k != 'yes') {
                 unset($invoice_ids[$invoice_id]);
             } else {
                 $invoice_ids[$invoice_id] = module_invoice::link_open($invoice_id, true);
             }
         }
         if (count($invoice_ids) > 0) {
             if (module_form::confirm_delete('invoice_id', _l("Really delete invoices: %s", implode(', ', $invoice_ids)), self::link_open(false))) {
                 foreach ($invoice_ids as $invoice_id => $invoice_number) {
                     self::delete_invoice($invoice_id);
                 }
                 set_message(_l("%s invoices deleted successfully", count($invoice_ids)));
                 redirect_browser(self::link_open(false));
             }
         }
     }
 }

    public function process()
    {
        if ("save_facebook" == $_REQUEST['_process']) {
            $social_facebook_id = isset($_REQUEST['social_facebook_id']) ? (int) $_REQUEST['social_facebook_id'] : 0;
            $facebook = new ucm_facebook_account($social_facebook_id);
            if (isset($_POST['butt_del']) && module_social::can_i('delete', 'Facebook', 'Social', 'social')) {
                if (module_form::confirm_delete('social_facebook_id', "Really delete this Facebook account from the system? All messages will be lost.", self::link_open($_REQUEST['social_facebook_id']))) {
                    $facebook->delete();
                    set_message("Facebook account deleted successfully");
                    redirect_browser(self::link_open(false));
                }
            }
            $facebook->save_data($_POST);
            $social_facebook_id = $facebook->get('social_facebook_id');
            if (isset($_POST['butt_save_connect'])) {
                $redirect = $this->link_open($social_facebook_id, false, false, 'facebook_account_connect');
            } else {
                set_message('Facebook account saved successfully');
                $redirect = $this->link_open($social_facebook_id);
            }
            redirect_browser($redirect);
            exit;
        } else {
            if ("send_facebook_message" == $_REQUEST['_process']) {
                if (module_form::check_secure_key()) {
                    $social_facebook_id = isset($_REQUEST['social_facebook_id']) ? (int) $_REQUEST['social_facebook_id'] : 0;
                    $facebook = new ucm_facebook_account($social_facebook_id);
                    if ($social_facebook_id && $facebook->get('social_facebook_id') == $social_facebook_id) {
                        // queue the message into the facebook_message table
                        // if there's a scheduled date in the past we send it in the past, no date we send straight away, date in the future we leave it in the db table for the cron job to pick up.
                        //print_r($_POST);exit;
                        $send_time = false;
                        // default: now
                        if (isset($_POST['schedule_date']) && isset($_POST['schedule_time']) && !empty($_POST['schedule_date']) && !empty($_POST['schedule_time'])) {
                            $date = $_POST['schedule_date'];
                            $time_hack = $_POST['schedule_time'];
                            $time_hack = str_ireplace('am', '', $time_hack);
                            $time_hack = str_ireplace('pm', '', $time_hack);
                            $bits = explode(':', $time_hack);
                            if (strpos($_POST['schedule_time'], 'pm')) {
                                $bits[0] += 12;
                            }
                            // add the time if it exists
                            $date .= ' ' . implode(':', $bits) . ':00';
                            $send_time = strtotime(input_date($date, true));
                        } else {
                            if (isset($_POST['schedule_date']) && !empty($_POST['schedule_date'])) {
                                $send_time = strtotime(input_date($_POST['schedule_date'], true));
                            }
                        }
                        //echo print_date($send_time,true);
                        //echo '<br>';
                        //echo date('c',$send_time);
                        //exit;
                        /* @var $available_pages ucm_facebook_page[] */
                        $available_pages = $facebook->get('pages');
                        $send_pages = isset($_POST['compose_page_id']) && is_array($_POST['compose_page_id']) ? $_POST['compose_page_id'] : array();
                        $page_count = 0;
                        if ($send_pages) {
                            foreach ($send_pages as $facebook_page_id => $tf) {
                                if (!$tf) {
                                    continue;
                                }
                                // see if this is an available page.
                                if (isset($available_pages[$facebook_page_id])) {
                                    // push to db! then send.
                                    $facebook_message = new ucm_facebook_message($facebook, $available_pages[$facebook_page_id], false);
                                    $facebook_message->create_new();
                                    $facebook_message->update('social_facebook_page_id', $available_pages[$facebook_page_id]->get('social_facebook_page_id'));
                                    $facebook_message->update('social_facebook_id', $facebook->get('social_facebook_id'));
                                    $facebook_message->update('summary', isset($_POST['message']) ? $_POST['message'] : '');
                                    $facebook_message->update('type', 'pending');
                                    $facebook_message->update('link', isset($_POST['link']) ? $_POST['link'] : '');
                                    $facebook_message->update('data', json_encode($_POST));
                                    $facebook_message->update('user_id', module_security::get_loggedin_id());
                                    // do we send this one now? or schedule it later.
                                    $facebook_message->update('status', _SOCIAL_MESSAGE_STATUS_PENDINGSEND);
                                    if ($send_time) {
                                        // schedule for sending at a different time (now or in the past)
                                        $facebook_message->update('last_active', $send_time);
                                    } else {
                                        // send it now.
                                        $facebook_message->update('last_active', 0);
                                    }
                                    if (isset($_FILES['picture']['tmp_name']) && is_uploaded_file($_FILES['picture']['tmp_name'])) {
                                        $facebook_message->add_attachment($_FILES['picture']['tmp_name']);
                                    }
                                    $facebook_message->send_queued(isset($_POST['debug']));
                                    $page_count++;
                                } else {
                                    // log error?
                                }
                            }
                        }
                        set_message(_l('Message delivered successfully to %s Facebook pages', $page_count));
                        $redirect = $this->link_open_message_view($social_facebook_id);
                        redirect_browser($redirect);
                    }
                }
            } else {
//.........這裏部分代碼省略.........

 public function process()
 {
     if ('language_reset' == $_REQUEST['_process'] && $_REQUEST['really'] == 'yes') {
         if (!module_form::check_secure_key()) {
             return;
         }
         // delete all language words and translations
         $sql = "DELETE FROM `" . _DB_PREFIX . "language_word` WHERE 1";
         query($sql);
         $sql = "DELETE FROM `" . _DB_PREFIX . "language_translation` WHERE 1";
         query($sql);
         set_message('Translation reset successfully');
         redirect_browser($_SERVER['REQUEST_URI']);
     }
     if ('remove_duplicates' == $_REQUEST['_process'] && isset($_REQUEST['duplicate_ids'])) {
         if (!module_form::check_secure_key()) {
             return;
         }
         $duplicate_ids = json_decode($_REQUEST['duplicate_ids'], true);
         foreach ($duplicate_ids as $duplicate_id) {
             $sql = "DELETE FROM `" . _DB_PREFIX . "language_word` WHERE language_word_id = '" . (int) $duplicate_id . "' LIMIT 1";
             query($sql);
         }
         set_message('Translation errors removed successfully');
         redirect_browser($_SERVER['REQUEST_URI']);
     } else {
         if ('language_duplicate_remove' == $_REQUEST['_process'] && $_REQUEST['really'] == 'yep') {
             if (!module_form::check_secure_key()) {
                 return;
             }
             // delete all language words and translations
             $sql = "SELECT `word`, COUNT(*) as cc FROM `" . _DB_PREFIX . "language_word`  GROUP BY `word` HAVING cc > 1";
             $res = qa($sql);
             foreach ($res as $r) {
                 if ($r['word'] && $r['cc'] > 1) {
                     // remove duplicates.
                     $sql = "SELECT * FROM `" . _DB_PREFIX . "language_word` WHERE `word` = '" . mysql_real_escape_string($r['word']) . "' ";
                     $duplicates = qa($sql);
                     // doing this due to incorrect collate in earlier version of UCM
                     $words_casesensitive = array();
                     foreach ($duplicates as $duplicate) {
                         $words_casesensitive[$duplicate['word']][$duplicate['language_word_id']] = $duplicate['language_word_id'];
                     }
                     //print_r($words_casesensitive);exit;
                     foreach ($words_casesensitive as $word => $duplicate_ids) {
                         if (count($duplicate_ids) > 1) {
                             $first = false;
                             foreach ($duplicate_ids as $language_word_id) {
                                 if ($first === false) {
                                     $first = $language_word_id;
                                 } else {
                                     if ($first) {
                                         // remove this one and replace any translations with the first one.
                                         $sql = "DELETE FROM `" . _DB_PREFIX . "language_word` WHERE language_word_id = '" . (int) $language_word_id . "' LIMIT 1";
                                         query($sql);
                                         $sql = "UPDATE `" . _DB_PREFIX . "language_translation` SET language_word_id = '" . (int) $first . "' WHERE language_word_id = '" . (int) $language_word_id . "'";
                                         query($sql);
                                     }
                                 }
                             }
                         }
                     }
                 }
             }
             $sql = "DELETE FROM `" . _DB_PREFIX . "language_word` WHERE `word` LIKE 'SQL Error%'";
             query($sql);
             // merge languages - error if case of language changes, keeps creating new language entries - eg FR fr
             $sql = "SELECT `language_id`, `language_code`, COUNT(*) as cc FROM `" . _DB_PREFIX . "language`  GROUP BY `language_code`";
             $res = query($sql);
             while ($row = mysql_fetch_assoc($res)) {
                 if ($row['cc'] > 1) {
                     // merge these!
                     $sql = "SELECT language_id FROM `" . _DB_PREFIX . "language` WHERE `language_code` = '" . mysql_real_escape_string($row['language_code']) . "' AND language_id != " . (int) $row['language_id'] . "";
                     $to_merge = query($sql);
                     while ($merge = mysql_fetch_assoc($to_merge)) {
                         $sql = "UPDATE `" . _DB_PREFIX . "language_translation` SET language_id = " . (int) $row['language_id'] . " WHERE language_id = " . (int) $merge['language_id'] . "";
                         query($sql);
                         // remove any that didn't update correctly (duplicate entries)
                         $sql = "DELETE FROM `" . _DB_PREFIX . "language_translation` WHERE language_id = " . (int) $merge['language_id'] . "";
                         query($sql);
                         $sql = "DELETE FROM `" . _DB_PREFIX . "language` WHERE language_id = " . (int) $merge['language_id'] . " LIMIT 1";
                         query($sql);
                     }
                 }
             }
             set_message('Translation duplicates removed successfully');
             redirect_browser($_SERVER['REQUEST_URI']);
         }
     }
     if ('save_language_translation' == $_REQUEST['_process']) {
         if (!module_form::check_secure_key()) {
             return;
         }
         if (!module_config::can_i('view', 'Settings')) {
             redirect_browser(_BASE_HREF);
         }
         if (!module_config::can_i('edit', 'Settings')) {
             redirect_browser(_BASE_HREF);
         }
         if (!module_language::can_i('edit', 'Language')) {
//.........這裏部分代碼省略.........

 /** methods  */
 public function process()
 {
     if (isset($_REQUEST['butt_del']) && $_REQUEST['butt_del'] && !empty($_REQUEST['customer_id']) && module_customer::can_i('delete', 'Customers')) {
         if (module_form::check_secure_key()) {
             $data = self::get_customer($_REQUEST['customer_id']);
             if ($data['customer_id'] && ($data['customer_id'] = $_REQUEST['customer_id'])) {
                 if (module_form::confirm_delete('customer_id', _l("Really delete customer: %s", $data['customer_name']), self::link_open($_REQUEST['customer_id']), array('options' => array(array('label' => _l('Also delete all Customer %s, Jobs, Invoices, Tickets and Files', module_config::c('project_name_plural')), 'name' => 'delete_others', 'type' => 'checkbox', 'value' => 1, 'checked' => true))))) {
                     $this->delete_customer($_REQUEST['customer_id'], isset($_REQUEST['delete_others']) && $_REQUEST['delete_others']);
                     set_message("Customer deleted successfully");
                     redirect_browser(self::link_open(false));
                 }
             }
         }
     } else {
         if (isset($_REQUEST['butt_del']) && $_REQUEST['butt_del'] && !empty($_REQUEST['customer_type_id'])) {
             if (module_form::check_secure_key()) {
                 $data = self::get_customer_type($_REQUEST['customer_type_id']);
                 if ($data['customer_type_id'] && ($data['customer_type_id'] = $_REQUEST['customer_type_id'])) {
                     if (module_form::confirm_delete('customer_type_id', _l("Really delete customer type: %s", $data['type_name']), self::link_open_customer_type($_REQUEST['customer_type_id']))) {
                         delete_from_db('customer_type', 'customer_type_id', $data['customer_type_id']);
                         $sql = "UPDATE `" . _DB_PREFIX . "customer` SET `customer_type_id` = 0 WHERE `customer_type_id` = " . (int) $data['customer_type_id'];
                         query($sql);
                         set_message("Customer type deleted successfully");
                         redirect_browser(self::link_open_customer_type(false));
                     }
                 }
             }
         } else {
             if ("ajax_contact_list" == $_REQUEST['_process']) {
                 $customer_id = isset($_REQUEST['customer_id']) ? (int) $_REQUEST['customer_id'] : 0;
                 $res = module_user::get_contacts(array('customer_id' => $customer_id));
                 $options = array();
                 foreach ($res as $row) {
                     $options[$row['user_id']] = $row['name'] . ' ' . $row['last_name'];
                 }
                 echo json_encode($options);
                 exit;
             } else {
                 if ("save_customer" == $_REQUEST['_process']) {
                     $customer_id = $this->save_customer($_REQUEST['customer_id'], $_POST);
                     hook_handle_callback('customer_save', $customer_id);
                     if (isset($_REQUEST['butt_send_email'])) {
                         redirect_browser(self::link_open($customer_id) . '&email=1');
                     } else {
                         set_message("Customer saved successfully");
                         redirect_browser(isset($_REQUEST['_redirect']) && !empty($_REQUEST['_redirect']) ? $_REQUEST['_redirect'] : self::link_open($customer_id));
                     }
                 } else {
                     if ("save_customer_type" == $_REQUEST['_process']) {
                         $customer_type_id = $this->save_customer_type($_REQUEST['customer_type_id'], $_POST);
                         hook_handle_callback('customer_save_type', $customer_type_id);
                         set_message("Customer saved successfully");
                         redirect_browser(isset($_REQUEST['_redirect']) && !empty($_REQUEST['_redirect']) ? $_REQUEST['_redirect'] : self::link_open_customer_type($customer_type_id));
                     }
                 }
             }
         }
     }
 }

    public function process()
    {
        if ("save_twitter" == $_REQUEST['_process']) {
            $social_twitter_id = isset($_REQUEST['social_twitter_id']) ? (int) $_REQUEST['social_twitter_id'] : 0;
            $twitter = new ucm_twitter_account($social_twitter_id);
            if (isset($_POST['butt_del']) && module_social::can_i('delete', 'Twitter', 'Social', 'social')) {
                if (module_form::confirm_delete('social_twitter_id', "Really delete this Twitter account from the system? All messages will be lost.", self::link_open($_REQUEST['social_twitter_id']))) {
                    $twitter->delete();
                    set_message("Twitter account deleted successfully");
                    redirect_browser(self::link_open(false));
                }
            }
            $twitter->save_data($_POST);
            $social_twitter_id = $twitter->get('social_twitter_id');
            if (isset($_POST['butt_save_connect'])) {
                $redirect = $this->link_open($social_twitter_id, false, false, 'twitter_account_connect');
            } else {
                set_message('Twitter account saved successfully');
                $redirect = $this->link_open($social_twitter_id);
            }
            redirect_browser($redirect);
            exit;
        } else {
            if ("send_twitter_message" == $_REQUEST['_process']) {
                if (module_form::check_secure_key()) {
                    // queue the message into the twitter_message table
                    // if there's a scheduled date in the past we send it in the past, no date we send straight away, date in the future we leave it in the db table for the cron job to pick up.
                    //print_r($_POST);exit;
                    $send_time = false;
                    // default: now
                    if (isset($_POST['schedule_date']) && isset($_POST['schedule_time']) && !empty($_POST['schedule_date']) && !empty($_POST['schedule_time'])) {
                        $date = $_POST['schedule_date'];
                        $time_hack = $_POST['schedule_time'];
                        $time_hack = str_ireplace('am', '', $time_hack);
                        $time_hack = str_ireplace('pm', '', $time_hack);
                        $bits = explode(':', $time_hack);
                        if (strpos($_POST['schedule_time'], 'pm')) {
                            $bits[0] += 12;
                        }
                        // add the time if it exists
                        $date .= ' ' . implode(':', $bits) . ':00';
                        $send_time = strtotime(input_date($date, true));
                    } else {
                        if (isset($_POST['schedule_date']) && !empty($_POST['schedule_date'])) {
                            $send_time = strtotime(input_date($_POST['schedule_date'], true));
                        }
                    }
                    //echo print_date($send_time,true);
                    //echo '<br>';
                    //echo date('c',$send_time);
                    //exit;
                    $send_accounts = isset($_POST['compose_account_id']) && is_array($_POST['compose_account_id']) ? $_POST['compose_account_id'] : array();
                    $page_count = 0;
                    $last_twitter_account_id = false;
                    if ($send_accounts) {
                        foreach ($send_accounts as $twitter_account_id => $tf) {
                            if (!$tf) {
                                continue;
                            }
                            // see if this is an available account.
                            $twitter_account = new ucm_twitter_account($twitter_account_id);
                            //todo: check permissiont o access thi saccount
                            if ($twitter_account->get('social_twitter_id') == $twitter_account_id) {
                                // push to db! then send.
                                $last_twitter_account_id = $twitter_account_id;
                                $twitter_message = new ucm_twitter_message($twitter_account, false);
                                $twitter_message->create_new();
                                $twitter_message->update('social_twitter_id', $twitter_account->get('social_twitter_id'));
                                $twitter_message->update('summary', isset($_POST['message']) ? $_POST['message'] : '');
                                $twitter_message->update('type', 'pending');
                                $twitter_message->update('data', json_encode($_POST));
                                $twitter_message->update('user_id', module_security::get_loggedin_id());
                                // do we send this one now? or schedule it later.
                                $twitter_message->update('status', _SOCIAL_MESSAGE_STATUS_PENDINGSEND);
                                if ($send_time) {
                                    // schedule for sending at a different time (now or in the past)
                                    $twitter_message->update('message_time', $send_time);
                                } else {
                                    // send it now.
                                    $twitter_message->update('message_time', 0);
                                }
                                if (isset($_FILES['picture']['tmp_name']) && is_uploaded_file($_FILES['picture']['tmp_name'])) {
                                    $twitter_message->add_attachment($_FILES['picture']['tmp_name']);
                                }
                                $twitter_message->send_queued(isset($_POST['debug']) && $_POST['debug']);
                                $page_count++;
                            } else {
                                // log error?
                            }
                        }
                    }
                    set_message(_l('Message delivered successfully to %s Twitter accounts', $page_count));
                    $redirect = $this->link_open_message_view($last_twitter_account_id);
                    redirect_browser($redirect);
                }
                exit;
            } else {
                if ("ajax_social_twitter" == $_REQUEST['_process']) {
                    // ajax functions from wdsocial. copied from the datafeed.php sample files.
                    header('Content-type: text/javascript');
//.........這裏部分代碼省略.........

 public function process()
 {
     if ('save_backup' == $_REQUEST['_process']) {
         if (!module_backup::can_i('edit', 'Backups')) {
             die('No perms to save backup.');
         }
         if (!module_form::check_secure_key()) {
             die('Invalid auth');
         }
         if (_DEMO_MODE) {
             die('Sorry, cannot make backups in demo mode.cd ');
         }
         $backup_id = update_insert('backup_id', $_REQUEST['backup_id'], 'backup', $_POST);
         if (isset($_REQUEST['butt_del']) && self::can_i('delete', 'Backups')) {
             // and the file.
             $backup = $this->get_backup($backup_id);
             if ($backup && $backup['backup_id'] == $backup_id && module_form::confirm_delete('backup_id', _l('Really delete this backup?'), self::link_open($backup_id))) {
                 if (isset($backup['backup_file']) && strlen($backup['backup_file'])) {
                     if (file_exists(_BACKUP_BASE_DIR . basename($backup['backup_file']) . '.sql')) {
                         @unlink(_BACKUP_BASE_DIR . basename($backup['backup_file']) . '.sql');
                     }
                     if (file_exists(_BACKUP_BASE_DIR . basename($backup['backup_file']) . '.sql.gz')) {
                         @unlink(_BACKUP_BASE_DIR . basename($backup['backup_file']) . '.sql.gz');
                     }
                     if (file_exists(_BACKUP_BASE_DIR . basename($backup['backup_file']) . '.zip')) {
                         @unlink(_BACKUP_BASE_DIR . basename($backup['backup_file']) . '.zip');
                     }
                 }
                 delete_from_db('backup', 'backup_id', $backup['backup_id']);
                 set_message('Backup deleted successfully.');
                 redirect_browser($this->link_open(false));
             }
         }
         set_message('Backup saved successfully');
         redirect_browser($this->link_open($backup_id));
     }
 }