Astral04/studiobeve.no
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Security hardening: fix SQLi, XSS, file upload, and migrate DB to RDS

Browse Source 
- Fix all SQL injection vulnerabilities across Service_model, User_model,
  Module_model, Log_model, and Admin controller using parameterized queries
- Add htmlspecialchars() to all user-controlled output in admin views
  (bookings, services, workers, service categories, login form)
- Fix XSS in AJAX worker response and manage-booking-cancelled view
- Add file extension whitelist (jpg, jpeg, png, gif, webp) to all uploads
- Remove webshell (pentest2.php) from assets/img/profiles/
- Stop logging plaintext passwords on failed login attempts
- Migrate database.php hostname from localhost to AWS RDS endpoint
- Fix dropdown styling (white-on-white) in worker calendar view

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Ubuntu
2026-05-07 13:00:32 +00:00
co-authored by Claude Opus 4.6
parent 307f17faa6
commit 420bcb37fd
20 changed files with 205 additions and 194 deletions
Download Patch File Download Diff File Expand all files Collapse all files
application/config/database.php
+1 -1
View File
@@ -75,7 +75,7 @@ $query_builder = TRUE;
$db['default'] = array( $db['default'] = array(
'dsn' => '', 'dsn' => '',
'hostname' => 'localhost', 'hostname' => 'database-1.chgossuk454l.eu-north-1.rds.amazonaws.com',
//'username' => 'root', //'username' => 'root',
'username' => 'gzsgtetc_beve', 'username' => 'gzsgtetc_beve',
//'password' => '', //'password' => '',
application/controllers/Admin.php
+11 -3
View File
@@ -167,7 +167,7 @@ class Admin extends CI_Controller {
$this->load->database(); $this->load->database();
$worker_id = $_GET['worker_id']; $worker_id = $_GET['worker_id'];
$data['selectedWorkerId'] = $worker_id; $data['selectedWorkerId'] = $worker_id;
$data['schedule'] = $this->db->query("SELECT * FROM worker_schedule WHERE worker_id = '$worker_id'")->result(); $data['schedule'] = $this->db->query("SELECT * FROM worker_schedule WHERE worker_id = ?", array($worker_id))->result();
} }
$this->load->view('admin/worker_schedule', $data); $this->load->view('admin/worker_schedule', $data);
@@ -580,8 +580,12 @@ class Admin extends CI_Controller {
$target_dir = getcwd()."/assets/img/"; $target_dir = getcwd()."/assets/img/";
$target_file = $target_dir . 'worker_'.str_replace(' ','_', $_POST['worker_name']); $target_file = $target_dir . 'worker_'.str_replace(' ','_', $_POST['worker_name']);
$imageFileType = strtolower(pathinfo(basename($_FILES["worker_img"]["name"]),PATHINFO_EXTENSION)); $imageFileType = strtolower(pathinfo(basename($_FILES["worker_img"]["name"]),PATHINFO_EXTENSION));
$allowedTypes = array('jpg', 'jpeg', 'png', 'gif', 'webp');
if (move_uploaded_file($_FILES["worker_img"]["tmp_name"], $target_file.'.'.$imageFileType)) { if (!in_array($imageFileType, $allowedTypes)) {
$data['message'] = 'Csak képfájlok engedélyezettek (jpg, png, gif, webp)!';
$data['message_class'] = 'errorMessage';
} elseif (move_uploaded_file($_FILES["worker_img"]["tmp_name"], $target_file.'.'.$imageFileType)) {
$data['message'] = 'A profilkép sikeresen feltöltve!'; $data['message'] = 'A profilkép sikeresen feltöltve!';
$data['message_class'] = 'successMessage'; $data['message_class'] = 'successMessage';
$data['worker_img'] = 'worker_'.str_replace(' ','_', $_POST['worker_name']).'.'.$imageFileType; $data['worker_img'] = 'worker_'.str_replace(' ','_', $_POST['worker_name']).'.'.$imageFileType;
@@ -628,8 +632,12 @@ class Admin extends CI_Controller {
$target_dir = getcwd()."/assets/img/"; $target_dir = getcwd()."/assets/img/";
$target_file = $target_dir . 'worker_'.str_replace(' ','_', $_POST['worker_name']); $target_file = $target_dir . 'worker_'.str_replace(' ','_', $_POST['worker_name']);
$imageFileType = strtolower(pathinfo(basename($_FILES["worker_img"]["name"]),PATHINFO_EXTENSION)); $imageFileType = strtolower(pathinfo(basename($_FILES["worker_img"]["name"]),PATHINFO_EXTENSION));
$allowedTypes = array('jpg', 'jpeg', 'png', 'gif', 'webp');
if (move_uploaded_file($_FILES["worker_img"]["tmp_name"], $target_file.'.'.$imageFileType)) { if (!in_array($imageFileType, $allowedTypes)) {
$data['message'] = 'Csak képfájlok engedélyezettek (jpg, png, gif, webp)!';
$data['message_class'] = 'errorMessage';
} elseif (move_uploaded_file($_FILES["worker_img"]["tmp_name"], $target_file.'.'.$imageFileType)) {
$data['message'] = 'A profilkép sikeresen feltöltve!'; $data['message'] = 'A profilkép sikeresen feltöltve!';
$data['message_class'] = 'successMessage'; $data['message_class'] = 'successMessage';
$data['worker_img'] = 'worker_'.str_replace(' ','_', $_POST['worker_name']).'.'.$imageFileType; $data['worker_img'] = 'worker_'.str_replace(' ','_', $_POST['worker_name']).'.'.$imageFileType;
application/controllers/Login.php
+1 -1
View File
@@ -72,7 +72,7 @@ class Login extends CI_Controller {
} }
else{ else{
$this->Log_model->addLog('login', 'Sikertelen bejelentkezési kísérlet - '.$_POST['username'].' / '.$_POST['password'],$_POST['username']); $this->Log_model->addLog('login', 'Sikertelen bejelentkezési kísérlet - '.$_POST['username'],$_POST['username']);
$data['message'] = 'Sikertelen bejelentkezés!'; $data['message'] = 'Sikertelen bejelentkezés!';
$data['message_class'] = 'error'; $data['message_class'] = 'error';
} }
application/controllers/Pages.php
+10 -6
View File
@@ -121,10 +121,10 @@ class Pages extends CI_Controller {
$workerListShow .= '<label for="worker_'.$workerItem->worker_id.'">'; $workerListShow .= '<label for="worker_'.$workerItem->worker_id.'">';
$workerListShow .= '<div class="profileRow">'; $workerListShow .= '<div class="profileRow">';
$workerListShow .= '<div class="profileCell profileRadioBtn"><input type="radio" name="worker_radio" class="workers" id="worker_'.$workerItem->worker_id.'" onclick="setWorker('.$workerItem->worker_id.')" '.($workerIndex==0?'checked':'').'></div>'; $workerListShow .= '<div class="profileCell profileRadioBtn"><input type="radio" name="worker_radio" class="workers" id="worker_'.$workerItem->worker_id.'" onclick="setWorker('.$workerItem->worker_id.')" '.($workerIndex==0?'checked':'').'></div>';
$workerListShow .= '<div class="profileCell profileImage"><img src="'.SITEURL.'assets/img/'.$workerItem->worker_profile_img.'"></div>'; $workerListShow .= '<div class="profileCell profileImage"><img src="'.SITEURL.'assets/img/'.htmlspecialchars($workerItem->worker_profile_img, ENT_QUOTES, 'UTF-8').'"></div>';
$workerListShow .= '<div class="profileCell">'; $workerListShow .= '<div class="profileCell">';
$workerListShow .= '<div class="profileName">'.$workerItem->worker_name.'</div>'; $workerListShow .= '<div class="profileName">'.htmlspecialchars($workerItem->worker_name, ENT_QUOTES, 'UTF-8').'</div>';
$workerListShow .= '<div class="profileDescription">'.$workerItem->worker_info.'</div>'; $workerListShow .= '<div class="profileDescription">'.htmlspecialchars($workerItem->worker_info, ENT_QUOTES, 'UTF-8').'</div>';
$workerListShow .= '</div>'; $workerListShow .= '</div>';
$workerListShow .= '</div>'; $workerListShow .= '</div>';
$workerListShow .= '</label>'; $workerListShow .= '</label>';
@@ -231,8 +231,8 @@ class Pages extends CI_Controller {
if(is_object($result)){ if(is_object($result)){
?> ?>
<div class="serviceBookingprofileImage" style="background-image:url('<?php echo SITEURL.'assets/img/'.$result->worker_profile_img;?>');"></div> <div class="serviceBookingprofileImage" style="background-image:url('<?php echo SITEURL.'assets/img/'.htmlspecialchars($result->worker_profile_img, ENT_QUOTES, 'UTF-8');?>');"></div>
<div class="serviceBookingprofileName"><?php echo $result->worker_name;?></div> <div class="serviceBookingprofileName"><?php echo htmlspecialchars($result->worker_name, ENT_QUOTES, 'UTF-8');?></div>
<?php <?php
@@ -620,8 +620,12 @@ class Pages extends CI_Controller {
$target_dir = getcwd()."/assets/img/profiles/"; $target_dir = getcwd()."/assets/img/profiles/";
$target_file = $target_dir . str_replace('.','_', str_replace('@','_',$_SESSION['username'])); $target_file = $target_dir . str_replace('.','_', str_replace('@','_',$_SESSION['username']));
$imageFileType = strtolower(pathinfo(basename($_FILES["profile_img"]["name"]),PATHINFO_EXTENSION)); $imageFileType = strtolower(pathinfo(basename($_FILES["profile_img"]["name"]),PATHINFO_EXTENSION));
$allowedTypes = array('jpg', 'jpeg', 'png', 'gif', 'webp');
if (move_uploaded_file($_FILES["profile_img"]["tmp_name"], $target_file.'.'.$imageFileType)) { if (!in_array($imageFileType, $allowedTypes)) {
$data['message'] = 'Csak képfájlok engedélyezettek (jpg, png, gif, webp)!';
$data['message_class'] = 'errorMessage';
} elseif (move_uploaded_file($_FILES["profile_img"]["tmp_name"], $target_file.'.'.$imageFileType)) {
$data['message'] = 'A profilkép sikeresen feltöltve!'; $data['message'] = 'A profilkép sikeresen feltöltve!';
$data['message_class'] = 'successMessage'; $data['message_class'] = 'successMessage';
$data['profile_img_url'] = 'assets/img/profiles/'.str_replace('.','_', str_replace('@','_',$_SESSION['username'])).'.'.$imageFileType; $data['profile_img_url'] = 'assets/img/profiles/'.str_replace('.','_', str_replace('@','_',$_SESSION['username'])).'.'.$imageFileType;
application/models/Log_model.php
+1 -1
View File
@@ -7,7 +7,7 @@ class Log_model extends CI_Model {
public function addLog($eventType, $eventContent, $username=""){ public function addLog($eventType, $eventContent, $username=""){
$this->load->database(); $this->load->database();
$query = $this->db->query("INSERT INTO system_log(event_type, event_content, username) VALUES('".$eventType."','".$eventContent."','".$username."');"); $query = $this->db->query("INSERT INTO system_log(event_type, event_content, username) VALUES(?, ?, ?)", array($eventType, $eventContent, $username));
} }
public function getAllLoginfo(){ public function getAllLoginfo(){
application/models/Module_model.php
+11 -6
View File
@@ -13,13 +13,13 @@ class Module_model extends CI_Model {
public function getModuleById($module_id){ public function getModuleById($module_id){
$this->load->database(); $this->load->database();
$query = $this->db->query('SELECT * FROM modules WHERE module_id = "'.$module_id.'" LIMIT 1;'); $query = $this->db->query('SELECT * FROM modules WHERE module_id = ? LIMIT 1', array($module_id));
return $query->result()[0]; return $query->result()[0];
} }
public function getModuleBySlug($module_slug){ public function getModuleBySlug($module_slug){
$this->load->database(); $this->load->database();
$query = $this->db->query('SELECT * FROM modules WHERE module_slug = "'.$module_slug.'" LIMIT 1;'); $query = $this->db->query('SELECT * FROM modules WHERE module_slug = ? LIMIT 1', array($module_slug));
return $query->result()[0]; return $query->result()[0];
} }
@@ -145,11 +145,16 @@ public function is_groupId_available_in_module($module_id, $groupId){
public function updateModule($fieldName, $module_id, $moduleUserArray){ public function updateModule($fieldName, $module_id, $moduleUserArray){
$this->load->database(); $this->load->database();
$allowedFields = array('permission_group_ids', 'permission_ids');
if (!in_array($fieldName, $allowedFields)) return;
if(!empty($moduleUserArray)){ if(!empty($moduleUserArray)){
$query = $this->db->query("UPDATE modules SET ".$fieldName." ='".serialize($moduleUserArray)."' WHERE module_id = '".$module_id."';"); $this->db->where('module_id', $module_id);
$this->db->update('modules', array($fieldName => serialize($moduleUserArray)));
} }
else{ else{
$query = $this->db->query("UPDATE modules SET ".$fieldName." ='' WHERE module_id = '".$module_id."';"); $this->db->where('module_id', $module_id);
$this->db->update('modules', array($fieldName => ''));
} }
} }
@@ -174,7 +179,7 @@ public function getModulesByPermissionSlug($permissionSlug){
public function getPermissionBySlug($permissionSlug){ public function getPermissionBySlug($permissionSlug){
$this->load->database(); $this->load->database();
$query = $this->db->query('SELECT * FROM permissions WHERE permission_slug = "'.$permissionSlug.'";'); $query = $this->db->query('SELECT * FROM permissions WHERE permission_slug = ?', array($permissionSlug));
if($query->num_rows() == 1){ if($query->num_rows() == 1){
return $query->result()[0]; return $query->result()[0];
} }
@@ -188,7 +193,7 @@ public function user_can_access_this_module($moduleSlug, $userId){
$this->load->model('User_model'); $this->load->model('User_model');
$selectedUser = $this->User_model->getUserById($userId); $selectedUser = $this->User_model->getUserById($userId);
$query = $this->db->query('SELECT * FROM modules WHERE module_slug = "'.$moduleSlug.'" LIMIT 1;'); $query = $this->db->query('SELECT * FROM modules WHERE module_slug = ? LIMIT 1', array($moduleSlug));
if($query->num_rows() == 1){ if($query->num_rows() == 1){
$result = $query->result()[0]; $result = $query->result()[0];
application/models/Service_model.php
+72 -78
View File
@@ -22,22 +22,22 @@ class Service_model extends CI_Model {
service_time, service_time,
service_category_id, service_category_id,
is_enabled is_enabled
) VALUES( ) VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)', array(
"'.$serviceArray['service_type'].'", $serviceArray['service_type'],
"'.$serviceArray['service_category_no'].'", $serviceArray['service_category_no'],
"'.$serviceArray['service_category_en'].'", $serviceArray['service_category_en'],
"'.$serviceArray['service_category_hu'].'", $serviceArray['service_category_hu'],
"'.$serviceArray['service_name_no'].'", $serviceArray['service_name_no'],
"'.$serviceArray['service_name_en'].'", $serviceArray['service_name_en'],
"'.$serviceArray['service_name_hu'].'", $serviceArray['service_name_hu'],
"'.$serviceArray['service_description_no'].'", $serviceArray['service_description_no'],
"'.$serviceArray['service_description_en'].'", $serviceArray['service_description_en'],
"'.$serviceArray['service_description_hu'].'", $serviceArray['service_description_hu'],
"'.$serviceArray['service_price'].'", $serviceArray['service_price'],
"'.$serviceArray['service_time'].'", $serviceArray['service_time'],
"'.$serviceArray['service_category_id'].'", $serviceArray['service_category_id'],
"'.$serviceArray['is_enabled'].'" $serviceArray['is_enabled']
);'); ));
} }
public function createServiceCategory($serviceCategoryArray){ public function createServiceCategory($serviceCategoryArray){
@@ -45,26 +45,22 @@ class Service_model extends CI_Model {
$query = $this->db->query('INSERT INTO service_categories ( $query = $this->db->query('INSERT INTO service_categories (
serv_cat_slug, serv_cat_slug,
serv_cat_name serv_cat_name
) VALUES( ) VALUES(?, ?)', array(
"'.$serviceCategoryArray['serv_cat_slug'].'", $serviceCategoryArray['serv_cat_slug'],
"'.$serviceCategoryArray['serv_cat_name'].'" $serviceCategoryArray['serv_cat_name']
);'); ));
} }
public function updateService($service_id, $serviceArray){ public function updateService($service_id, $serviceArray){
$this->load->database(); $this->load->database();
$this->db->where('service_id', $service_id);
foreach($serviceArray as $propertyKey => $propertyValue){ $this->db->update('services', $serviceArray);
$query = $this->db->query('UPDATE services SET '.$propertyKey.' = "'.$propertyValue.'" WHERE service_id = "'.$service_id.'";');
}
} }
public function updateServiceCategory($service_category_id, $serviceCategoryArray){ public function updateServiceCategory($service_category_id, $serviceCategoryArray){
$this->load->database(); $this->load->database();
$this->db->where('service_category_id', $service_category_id);
foreach($serviceCategoryArray as $propertyKey => $propertyValue){ $this->db->update('service_categories', $serviceCategoryArray);
$query = $this->db->query('UPDATE service_categories SET '.$propertyKey.' = "'.$propertyValue.'" WHERE service_category_id = "'.$service_category_id.'";');
}
} }
public function createWorker($workerArray){ public function createWorker($workerArray){
@@ -76,22 +72,20 @@ class Service_model extends CI_Model {
is_beauty, is_beauty,
is_barber, is_barber,
service_category_id service_category_id
) VALUES( ) VALUES(?, ?, ?, ?, ?, ?)', array(
"'.$workerArray['worker_name'].'", $workerArray['worker_name'],
"'.$workerArray['worker_profile_img'].'", $workerArray['worker_profile_img'],
"'.$workerArray['worker_info'].'", $workerArray['worker_info'],
"'.$workerArray['is_beauty'].'", $workerArray['is_beauty'],
"'.$workerArray['is_barber'].'", $workerArray['is_barber'],
"'.$workerArray['service_category_id'].'" $workerArray['service_category_id']
);'); ));
} }
public function updateWorker($worker_id, $workerArray){ public function updateWorker($worker_id, $workerArray){
$this->load->database(); $this->load->database();
$this->db->where('worker_id', $worker_id);
foreach($workerArray as $propertyKey => $propertyValue){ $this->db->update('workers', $workerArray);
$query = $this->db->query('UPDATE workers SET '.$propertyKey.' = "'.$propertyValue.'" WHERE worker_id = "'.$worker_id.'";');
}
} }
public function updateBooking($booking_id, $bookingArray){ public function updateBooking($booking_id, $bookingArray){
@@ -102,7 +96,7 @@ class Service_model extends CI_Model {
public function getAllServiceByServiceType($service_type, $lang){ public function getAllServiceByServiceType($service_type, $lang){
$this->load->database(); $this->load->database();
$query = $this->db->query('SELECT * FROM services JOIN service_categories ON services.service_category_id = service_categories.service_category_id WHERE service_type = "'.$service_type.'" AND services.is_enabled = "1" AND services.is_deleted != "1" ORDER BY service_id ASC;'); $query = $this->db->query('SELECT * FROM services JOIN service_categories ON services.service_category_id = service_categories.service_category_id WHERE service_type = ? AND services.is_enabled = "1" AND services.is_deleted != "1" ORDER BY service_id ASC', array($service_type));
$serviceArray = array(); $serviceArray = array();
if($query->num_rows() > 0){ if($query->num_rows() > 0){
foreach($query->result() as $resultItem){ foreach($query->result() as $resultItem){
@@ -149,7 +143,7 @@ class Service_model extends CI_Model {
public function getServiceById($service_id){ public function getServiceById($service_id){
$this->load->database(); $this->load->database();
$query = $this->db->query('SELECT * FROM services WHERE service_id = "'.$service_id.'" LIMIT 1;'); $query = $this->db->query('SELECT * FROM services WHERE service_id = ? LIMIT 1', array($service_id));
if($query->num_rows() > 0){ if($query->num_rows() > 0){
return $query->result()[0]; return $query->result()[0];
} }
@@ -160,7 +154,7 @@ class Service_model extends CI_Model {
public function getServiceCategoryById($service_category_id){ public function getServiceCategoryById($service_category_id){
$this->load->database(); $this->load->database();
$query = $this->db->query('SELECT * FROM service_categories WHERE service_category_id = "'.$service_category_id.'" LIMIT 1;'); $query = $this->db->query('SELECT * FROM service_categories WHERE service_category_id = ? LIMIT 1', array($service_category_id));
if($query->num_rows() > 0){ if($query->num_rows() > 0){
return $query->result()[0]; return $query->result()[0];
} }
@@ -218,7 +212,7 @@ class Service_model extends CI_Model {
public function getWorkersByCategorySlug($serv_cat_slug){ public function getWorkersByCategorySlug($serv_cat_slug){
$this->load->database(); $this->load->database();
$query = $this->db->query('SELECT * FROM workers JOIN service_categories ON workers.service_category_id = service_categories.service_category_id WHERE workers.is_deleted != "1" AND serv_cat_slug = "'.$serv_cat_slug.'" ORDER BY worker_name ASC;'); $query = $this->db->query('SELECT * FROM workers JOIN service_categories ON workers.service_category_id = service_categories.service_category_id WHERE workers.is_deleted != "1" AND serv_cat_slug = ? ORDER BY worker_name ASC', array($serv_cat_slug));
return $query->result(); return $query->result();
} }
@@ -242,7 +236,7 @@ class Service_model extends CI_Model {
public function deleteBooking($booking_id){ public function deleteBooking($booking_id){
$this->load->database(); $this->load->database();
$query = $this->db->query('DELETE FROM bookings WHERE booking_id = "'.$booking_id.'";'); $query = $this->db->query('DELETE FROM bookings WHERE booking_id = ?', array($booking_id));
} }
public function getAllBookings(){ public function getAllBookings(){
@@ -337,7 +331,7 @@ class Service_model extends CI_Model {
$this->load->database(); $this->load->database();
$this->load->model('Service_model'); $this->load->model('Service_model');
$query = $this->db->query('SELECT * FROM bookings JOIN workers ON bookings.worker_id = workers.worker_id WHERE booking_date >= CURDATE() AND bookings.worker_id = "'.$workerID.'" ORDER BY booking_date DESC, booking_start_time ASC;'); $query = $this->db->query('SELECT * FROM bookings JOIN workers ON bookings.worker_id = workers.worker_id WHERE booking_date >= CURDATE() AND bookings.worker_id = ? ORDER BY booking_date DESC, booking_start_time ASC', array($workerID));
if($query->num_rows() > 0){ if($query->num_rows() > 0){
$resultsArray = array(); $resultsArray = array();
@@ -381,7 +375,7 @@ class Service_model extends CI_Model {
$this->load->database(); $this->load->database();
$this->load->model('Service_model'); $this->load->model('Service_model');
$query = $this->db->query('SELECT * FROM bookings WHERE booking_id = "'.$booking_id.'" LIMIT 1;'); $query = $this->db->query('SELECT * FROM bookings WHERE booking_id = ? LIMIT 1', array($booking_id));
if($query->num_rows() > 0){ if($query->num_rows() > 0){
return $query->result()[0]; return $query->result()[0];
} }
@@ -392,7 +386,7 @@ class Service_model extends CI_Model {
public function getWorkerById($worker_id){ public function getWorkerById($worker_id){
$this->load->database(); $this->load->database();
$query = $this->db->query('SELECT * FROM workers WHERE worker_id = "'.$worker_id.'" LIMIT 1;'); $query = $this->db->query('SELECT * FROM workers WHERE worker_id = ? LIMIT 1', array($worker_id));
if($query->num_rows() > 0){ if($query->num_rows() > 0){
return $query->result()[0]; return $query->result()[0];
} }
@@ -430,9 +424,9 @@ class Service_model extends CI_Model {
// --- Override ellenőrzés --- // --- Override ellenőrzés ---
$overrideQuery = $this->db->query(" $overrideQuery = $this->db->query("
SELECT * FROM worker_schedule_overrides SELECT * FROM worker_schedule_overrides
WHERE worker_id = '$worker_id' AND date = '$selectedDate' WHERE worker_id = ? AND date = ?
LIMIT 1 LIMIT 1
"); ", array($worker_id, $selectedDate));
if ($overrideQuery->num_rows() > 0) { if ($overrideQuery->num_rows() > 0) {
$override = $overrideQuery->row(); $override = $overrideQuery->row();
@@ -448,13 +442,13 @@ class Service_model extends CI_Model {
$scheduleQuery = $this->db->query(" $scheduleQuery = $this->db->query("
SELECT * FROM worker_schedule SELECT * FROM worker_schedule
WHERE worker_id = '{$worker_id}' WHERE worker_id = ?
AND weekday = '{$weekday}' AND weekday = ?
AND ( AND (
is_alternate_week = 0 is_alternate_week = 0
OR (is_alternate_week = 1 AND " . ($isOddWeek ? "1" : "0") . ") OR (is_alternate_week = 1 AND " . ($isOddWeek ? "1" : "0") . ")
) )
"); ", array($worker_id, $weekday));
if ($scheduleQuery->num_rows() == 0) { if ($scheduleQuery->num_rows() == 0) {
return []; return [];
@@ -490,7 +484,7 @@ class Service_model extends CI_Model {
// --- Lunch break setup --- // --- Lunch break setup ---
// Pre-fetch all bookings for the day so we can do hypothetical checks per slot // Pre-fetch all bookings for the day so we can do hypothetical checks per slot
$workerRow = $this->db->query("SELECT lunch_window_start, lunch_window_end, lunch_preferred_time FROM workers WHERE worker_id = '$worker_id' LIMIT 1")->row(); $workerRow = $this->db->query("SELECT lunch_window_start, lunch_window_end, lunch_preferred_time FROM workers WHERE worker_id = ? LIMIT 1", array($worker_id))->row();
$shiftSeconds = $finishTime->getTimestamp() - $dayStartTime->getTimestamp(); $shiftSeconds = $finishTime->getTimestamp() - $dayStartTime->getTimestamp();
$lunchRequired = $workerRow && $workerRow->lunch_window_start && $workerRow->lunch_window_end && $shiftSeconds >= 6 * 3600; $lunchRequired = $workerRow && $workerRow->lunch_window_start && $workerRow->lunch_window_end && $shiftSeconds >= 6 * 3600;
@@ -498,8 +492,8 @@ class Service_model extends CI_Model {
if ($lunchRequired) { if ($lunchRequired) {
$allBookings = $this->db->query(" $allBookings = $this->db->query("
SELECT booking_start_time, booking_finish_time FROM bookings SELECT booking_start_time, booking_finish_time FROM bookings
WHERE booking_date = '$selectedDate' AND worker_id = '$worker_id' WHERE booking_date = ? AND worker_id = ?
")->result(); ", array($selectedDate, $worker_id))->result();
} }
$interval = new DateInterval('PT15M'); $interval = new DateInterval('PT15M');
@@ -516,10 +510,10 @@ class Service_model extends CI_Model {
$bookingQuery = $this->db->query(" $bookingQuery = $this->db->query("
SELECT * FROM bookings SELECT * FROM bookings
WHERE booking_date = '{$selectedDate}' WHERE booking_date = ?
AND worker_id = '{$worker_id}' AND worker_id = ?
AND booking_start_time < '{$endTimeStr}' AND booking_finish_time > '{$startTimeStr}' AND booking_start_time < ? AND booking_finish_time > ?
"); ", array($selectedDate, $worker_id, $endTimeStr, $startTimeStr));
if ($bookingQuery->num_rows() > 0) continue; // already booked if ($bookingQuery->num_rows() > 0) continue; // already booked
@@ -564,30 +558,30 @@ class Service_model extends CI_Model {
guest_confirmed, guest_confirmed,
guest_confirm_code, guest_confirm_code,
manage_token manage_token
) VALUES( ) VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)", array(
'".$bookingArray['guest_name']."', $bookingArray['guest_name'],
'".$bookingArray['guest_email']."', $bookingArray['guest_email'],
'".$bookingArray['guest_phone']."', $bookingArray['guest_phone'],
'".$bookingArray['worker_id']."', $bookingArray['worker_id'],
'".$bookingArray['booking_date']."', $bookingArray['booking_date'],
'".$bookingArray['booking_start_time']."', $bookingArray['booking_start_time'],
'".$bookingArray['booking_finish_time']."', $bookingArray['booking_finish_time'],
'".$bookingArray['service_ids']."', $bookingArray['service_ids'],
'".$bookingArray['guest_confirmed']."', $bookingArray['guest_confirmed'],
'".$bookingArray['guest_confirm_code']."', $bookingArray['guest_confirm_code'],
'".$bookingArray['manage_token']."' $bookingArray['manage_token']
);"); ));
} }
public function getBookingByToken($token){ public function getBookingByToken($token){
$this->load->database(); $this->load->database();
$query = $this->db->query('SELECT * FROM bookings WHERE manage_token = "'.$this->db->escape_str($token).'" LIMIT 1;'); $query = $this->db->query('SELECT * FROM bookings WHERE manage_token = ? LIMIT 1', array($token));
return $query->num_rows() > 0 ? $query->result()[0] : false; return $query->num_rows() > 0 ? $query->result()[0] : false;
} }
public function updateBookingCalEvents($booking_id, $worker_event_id, $owner_event_id){ public function updateBookingCalEvents($booking_id, $worker_event_id, $owner_event_id){
$this->load->database(); $this->load->database();
$this->db->query("UPDATE bookings SET gcal_event_id_worker = '".$this->db->escape_str($worker_event_id)."', gcal_event_id_owner = '".$this->db->escape_str($owner_event_id)."' WHERE booking_id = '".$this->db->escape_str($booking_id)."';"); $this->db->query("UPDATE bookings SET gcal_event_id_worker = ?, gcal_event_id_owner = ? WHERE booking_id = ?", array($worker_event_id, $owner_event_id, $booking_id));
} }
public function getWorkerSchedule($worker_id) { public function getWorkerSchedule($worker_id) {
@@ -790,13 +784,13 @@ class Service_model extends CI_Model {
$query = $this->db->query(" $query = $this->db->query("
SELECT * FROM worker_schedule SELECT * FROM worker_schedule
WHERE worker_id = '{$worker_id}' WHERE worker_id = ?
AND weekday = '{$weekday}' AND weekday = ?
AND ( AND (
is_alternate_week = 0 is_alternate_week = 0
OR (is_alternate_week = 1 AND " . ($isOddWeek ? "1" : "0") . ") OR (is_alternate_week = 1 AND " . ($isOddWeek ? "1" : "0") . ")
) )
"); ", array($worker_id, $weekday));
return $query->num_rows() > 0; return $query->num_rows() > 0;
} }
application/models/User_model.php
+11 -13
View File
@@ -14,7 +14,7 @@ class User_model extends CI_Model {
public function userCanLogin($username, $password){ public function userCanLogin($username, $password){
$this->load->database(); $this->load->database();
$query = $this->db->query('SELECT * FROM users WHERE username = "'.$username.'" AND password = "'.hash('sha256', $password).'" AND is_enabled = 1 LIMIT 1'); $query = $this->db->query('SELECT * FROM users WHERE username = ? AND password = ? AND is_enabled = 1 LIMIT 1', array($username, hash('sha256', $password)));
if($query->num_rows() == 1){ if($query->num_rows() == 1){
return 1; return 1;
@@ -39,7 +39,7 @@ class User_model extends CI_Model {
public function getUserByUsername($username){ public function getUserByUsername($username){
$this->load->database(); $this->load->database();
$query = $this->db->query('SELECT * FROM users JOIN permissions ON users.permission_slug = permissions.permission_slug WHERE username = "'.$username.'" LIMIT 1'); $query = $this->db->query('SELECT * FROM users JOIN permissions ON users.permission_slug = permissions.permission_slug WHERE username = ? LIMIT 1', array($username));
if($query->num_rows() == 1){ if($query->num_rows() == 1){
if($query->result()[0]->profile_img_url == ''){ if($query->result()[0]->profile_img_url == ''){
@@ -64,7 +64,7 @@ class User_model extends CI_Model {
} }
public function getUserById($userId){ public function getUserById($userId){
$this->load->database(); $this->load->database();
$query = $this->db->query('SELECT * FROM users JOIN permissions ON users.permission_slug = permissions.permission_slug WHERE user_id = "'.$userId.'" LIMIT 1'); $query = $this->db->query('SELECT * FROM users JOIN permissions ON users.permission_slug = permissions.permission_slug WHERE user_id = ? LIMIT 1', array($userId));
if($query->num_rows() == 1){ if($query->num_rows() == 1){
if($query->result()[0]->profile_img_url == ''){ if($query->result()[0]->profile_img_url == ''){
$query->result()[0]->profile_img_url = base_url().'img/default_profile.jpg'; $query->result()[0]->profile_img_url = base_url().'img/default_profile.jpg';
@@ -78,12 +78,12 @@ class User_model extends CI_Model {
public function deleteUser($userId){ public function deleteUser($userId){
$this->load->database(); $this->load->database();
$query = $this->db->query('DELETE FROM users WHERE user_id = "'.$userId.'";'); $query = $this->db->query('DELETE FROM users WHERE user_id = ?', array($userId));
} }
public function isUsernameAvailable($username){ public function isUsernameAvailable($username){
$this->load->database(); $this->load->database();
$query = $this->db->query('SELECT * FROM users WHERE username = "'.$username.'";'); $query = $this->db->query('SELECT * FROM users WHERE username = ?', array($username));
if($query->num_rows() == 1){ if($query->num_rows() == 1){
return 0; return 0;
} }
@@ -94,17 +94,15 @@ class User_model extends CI_Model {
public function updateUser($userId, $userArray){ public function updateUser($userId, $userArray){
$this->load->database(); $this->load->database();
$this->db->where('user_id', $userId);
foreach($userArray as $propertyKey => $propertyValue){ $this->db->update('users', $userArray);
$query = $this->db->query('UPDATE users SET '.$propertyKey.' = "'.$propertyValue.'" WHERE user_id = "'.$userId.'";');
}
} }
public function addNewUser($userArray){ public function addNewUser($userArray){
$this->load->database(); $this->load->database();
if(!is_object($this->getUserByUsername($userArray['username']))){ if(!is_object($this->getUserByUsername($userArray['username']))){
$query = $this->db->query('INSERT INTO users (username, password, fullname, permission_slug, is_enabled, user_notes) VALUES("'.$userArray['username'].'", "'.hash('sha256', $userArray['password']).'", "'.$userArray['fullname'].'", "'.$userArray['permission_slug'].'", "'.$userArray['is_enabled'].'", "'.$userArray['user_notes'].'");'); $query = $this->db->query('INSERT INTO users (username, password, fullname, permission_slug, is_enabled, user_notes) VALUES(?, ?, ?, ?, ?, ?)', array($userArray['username'], hash('sha256', $userArray['password']), $userArray['fullname'], $userArray['permission_slug'], $userArray['is_enabled'], $userArray['user_notes']));
return 1; return 1;
} }
else{ else{
@@ -121,13 +119,13 @@ class User_model extends CI_Model {
public function getPermissionById($groupId){ public function getPermissionById($groupId){
$this->load->database(); $this->load->database();
$query = $this->db->query('SELECT * FROM permissions WHERE permission_id = "'.$groupId.'" LIMIT 1;'); $query = $this->db->query('SELECT * FROM permissions WHERE permission_id = ? LIMIT 1', array($groupId));
return $query->result()[0]; return $query->result()[0];
} }
public function getPermissionBySlug($permission_slug){ public function getPermissionBySlug($permission_slug){
$this->load->database(); $this->load->database();
$query = $this->db->query('SELECT * FROM permissions WHERE permission_slug = "'.$permission_slug.'" LIMIT 1;'); $query = $this->db->query('SELECT * FROM permissions WHERE permission_slug = ? LIMIT 1', array($permission_slug));
return $query->result()[0]; return $query->result()[0];
} }
@@ -202,7 +200,7 @@ class User_model extends CI_Model {
public function is_user_admin($username){ public function is_user_admin($username){
$this->load->database(); $this->load->database();
$query = $this->db->query('SELECT * FROM users JOIN permissions ON users.permission_slug = permissions.permission_slug WHERE username = "'.$username.'" LIMIT 1'); $query = $this->db->query('SELECT * FROM users JOIN permissions ON users.permission_slug = permissions.permission_slug WHERE username = ? LIMIT 1', array($username));
if($query->num_rows() == 1){ if($query->num_rows() == 1){
if($query->result()[0]->permission_slug == 'admin'){ if($query->result()[0]->permission_slug == 'admin'){
return 1; return 1;
application/views/admin/includes/bookings-form.php
+12 -12
View File
@@ -36,14 +36,14 @@
<a href="<?php echo SITEURL;?>bookings/update-booking/<?php echo $resultItem->booking_id ;?>"><i class="fas fa-edit"></i></a> <a href="<?php echo SITEURL;?>bookings/update-booking/<?php echo $resultItem->booking_id ;?>"><i class="fas fa-edit"></i></a>
| <a href="<?php echo site_url().'bookings/booking-process?delete-booking='.$resultItem->booking_id;?>" onclick="return confirm('Valóban törölni szeretnéd?');"><i class="fas fa-trash-alt" style="font-size: 14px;color:#585858;"></i></a> | <a href="<?php echo site_url().'bookings/booking-process?delete-booking='.$resultItem->booking_id;?>" onclick="return confirm('Valóban törölni szeretnéd?');"><i class="fas fa-trash-alt" style="font-size: 14px;color:#585858;"></i></a>
</td> </td>
<td>#<?php echo $resultItem->booking_id;?></td> <td>#<?php echo htmlspecialchars($resultItem->booking_id, ENT_QUOTES, 'UTF-8');?></td>
<td><?php echo $resultItem->guest_name;?></td> <td><?php echo htmlspecialchars($resultItem->guest_name, ENT_QUOTES, 'UTF-8');?></td>
<td><?php echo $resultItem->guest_email;?></td> <td><?php echo htmlspecialchars($resultItem->guest_email, ENT_QUOTES, 'UTF-8');?></td>
<td><?php echo $resultItem->guest_phone;?></td> <td><?php echo htmlspecialchars($resultItem->guest_phone, ENT_QUOTES, 'UTF-8');?></td>
<td><?php echo $resultItem->worker_name;?></td> <td><?php echo htmlspecialchars($resultItem->worker_name, ENT_QUOTES, 'UTF-8');?></td>
<td style="min-width:85px;"><?php echo $resultItem->booking_date;?></td> <td style="min-width:85px;"><?php echo htmlspecialchars($resultItem->booking_date, ENT_QUOTES, 'UTF-8');?></td>
<td><?php echo $resultItem->booking_start_time;?></td> <td><?php echo htmlspecialchars($resultItem->booking_start_time, ENT_QUOTES, 'UTF-8');?></td>
<td><?php echo $resultItem->booking_finish_time;?></td> <td><?php echo htmlspecialchars($resultItem->booking_finish_time, ENT_QUOTES, 'UTF-8');?></td>
<td><?php <td><?php
if(!empty($resultItem->services)){ if(!empty($resultItem->services)){
echo '<table class="tableInTable">'; echo '<table class="tableInTable">';
@@ -55,10 +55,10 @@
echo '</tr>'; echo '</tr>';
foreach($resultItem->services as $serviceItem){ foreach($resultItem->services as $serviceItem){
echo '<tr>'; echo '<tr>';
echo '<td>'.$serviceItem->service_type.'</td>'; echo '<td>'.htmlspecialchars($serviceItem->service_type, ENT_QUOTES, 'UTF-8').'</td>';
echo '<td>'.$serviceItem->service_name.'</td>'; echo '<td>'.htmlspecialchars($serviceItem->service_name, ENT_QUOTES, 'UTF-8').'</td>';
echo '<td>'.$serviceItem->service_price.'</td>'; echo '<td>'.htmlspecialchars($serviceItem->service_price, ENT_QUOTES, 'UTF-8').'</td>';
echo '<td>'.$serviceItem->service_time.'</td>'; echo '<td>'.htmlspecialchars($serviceItem->service_time, ENT_QUOTES, 'UTF-8').'</td>';
echo '</tr>'; echo '</tr>';
} }
echo '</table>'; echo '</table>';
application/views/admin/includes/service-categories-form.php
+2 -2
View File
@@ -21,8 +21,8 @@
| <a href="<?php echo site_url().'services/service-category-process?delete-service-category='.$resultItem->service_category_id;?>" onclick="return confirm('Valóban törölni szeretnéd?');"><i class="fas fa-trash-alt" style="font-size: 14px;color:#585858;"></i></a> | <a href="<?php echo site_url().'services/service-category-process?delete-service-category='.$resultItem->service_category_id;?>" onclick="return confirm('Valóban törölni szeretnéd?');"><i class="fas fa-trash-alt" style="font-size: 14px;color:#585858;"></i></a>
</td> </td>
<td>#<?php echo $resultItem->service_category_id;?></td> <td>#<?php echo $resultItem->service_category_id;?></td>
<td><?php echo $resultItem->serv_cat_slug;?></td> <td><?php echo htmlspecialchars($resultItem->serv_cat_slug, ENT_QUOTES, 'UTF-8');?></td>
<td><?php echo $resultItem->serv_cat_name;?></td> <td><?php echo htmlspecialchars($resultItem->serv_cat_name, ENT_QUOTES, 'UTF-8');?></td>
</tr> </tr>
<?php <?php
} }
application/views/admin/includes/services-form.php
+15 -15
View File
@@ -29,23 +29,23 @@
?> ?>
<tr> <tr>
<td> <td>
<a href="<?php echo SITEURL;?>services/update-service/<?php echo $resultItem->service_id;?>"><i class="fas fa-edit"></i></a> <a href="<?php echo SITEURL;?>services/update-service/<?php echo htmlspecialchars($resultItem->service_id, ENT_QUOTES, 'UTF-8');?>"><i class="fas fa-edit"></i></a>
| <a href="<?php echo site_url().'services/service-process?delete-service='.$resultItem->service_id;?>" onclick="return confirm('Valóban törölni szeretnéd?');"><i class="fas fa-trash-alt" style="font-size: 14px;color:#585858;"></i></a> | <a href="<?php echo site_url().'services/service-process?delete-service='.$resultItem->service_id;?>" onclick="return confirm('Valóban törölni szeretnéd?');"><i class="fas fa-trash-alt" style="font-size: 14px;color:#585858;"></i></a>
</td> </td>
<td>#<?php echo $resultItem->service_id;?></td> <td>#<?php echo htmlspecialchars($resultItem->service_id, ENT_QUOTES, 'UTF-8');?></td>
<td><?php echo $resultItem->service_type;?></td> <td><?php echo htmlspecialchars($resultItem->service_type, ENT_QUOTES, 'UTF-8');?></td>
<td><?php echo $resultItem->service_category_no;?></td> <td><?php echo htmlspecialchars($resultItem->service_category_no, ENT_QUOTES, 'UTF-8');?></td>
<td><?php echo $resultItem->service_category_en;?></td> <td><?php echo htmlspecialchars($resultItem->service_category_en, ENT_QUOTES, 'UTF-8');?></td>
<td><?php echo $resultItem->service_category_hu;?></td> <td><?php echo htmlspecialchars($resultItem->service_category_hu, ENT_QUOTES, 'UTF-8');?></td>
<td><?php echo $resultItem->service_name_no;?></td> <td><?php echo htmlspecialchars($resultItem->service_name_no, ENT_QUOTES, 'UTF-8');?></td>
<td><?php echo $resultItem->service_name_en;?></td> <td><?php echo htmlspecialchars($resultItem->service_name_en, ENT_QUOTES, 'UTF-8');?></td>
<td><?php echo $resultItem->service_name_hu;?></td> <td><?php echo htmlspecialchars($resultItem->service_name_hu, ENT_QUOTES, 'UTF-8');?></td>
<td><?php echo $resultItem->service_description_no;?></td> <td><?php echo htmlspecialchars($resultItem->service_description_no, ENT_QUOTES, 'UTF-8');?></td>
<td><?php echo $resultItem->service_description_en;?></td> <td><?php echo htmlspecialchars($resultItem->service_description_en, ENT_QUOTES, 'UTF-8');?></td>
<td><?php echo $resultItem->service_description_hu;?></td> <td><?php echo htmlspecialchars($resultItem->service_description_hu, ENT_QUOTES, 'UTF-8');?></td>
<td><?php echo $resultItem->service_price;?></td> <td><?php echo htmlspecialchars($resultItem->service_price, ENT_QUOTES, 'UTF-8');?></td>
<td><?php echo $resultItem->service_time;?></td> <td><?php echo htmlspecialchars($resultItem->service_time, ENT_QUOTES, 'UTF-8');?></td>
<td><?php echo $resultItem->serv_cat_name;?></td> <td><?php echo htmlspecialchars($resultItem->serv_cat_name, ENT_QUOTES, 'UTF-8');?></td>
<td><?php echo $resultItem->is_enabled?'igen':'nem';?></td> <td><?php echo $resultItem->is_enabled?'igen':'nem';?></td>
</tr> </tr>
<?php <?php
application/views/admin/includes/update-booking-form.php
+4 -4
View File
@@ -5,22 +5,22 @@
<input type="hidden" name="booking_id" value="<?php echo $selectedItem->booking_id;?>"> <input type="hidden" name="booking_id" value="<?php echo $selectedItem->booking_id;?>">
<div class="formRow"> <div class="formRow">
<label class="formTitle">Vendég neve</label> <label class="formTitle">Vendég neve</label>
<input type="text" class="formInputBox" name="guest_name" value="<?php echo $selectedItem->guest_name;?>"> <input type="text" class="formInputBox" name="guest_name" value="<?php echo htmlspecialchars($selectedItem->guest_name, ENT_QUOTES, 'UTF-8');?>">
</div> </div>
<div class="formRow"> <div class="formRow">
<label class="formTitle">Email</label> <label class="formTitle">Email</label>
<input type="text" class="formInputBox" name="guest_email" value="<?php echo $selectedItem->guest_email;?>"> <input type="text" class="formInputBox" name="guest_email" value="<?php echo htmlspecialchars($selectedItem->guest_email, ENT_QUOTES, 'UTF-8');?>">
</div> </div>
<div class="formRow"> <div class="formRow">
<label class="formTitle">Telefon</label> <label class="formTitle">Telefon</label>
<input type="text" class="formInputBox" name="guest_phone" value="<?php echo $selectedItem->guest_phone;?>"> <input type="text" class="formInputBox" name="guest_phone" value="<?php echo htmlspecialchars($selectedItem->guest_phone, ENT_QUOTES, 'UTF-8');?>">
</div> </div>
<div class="formRow"> <div class="formRow">
<label class="formTitle">Dolgozó</label> <label class="formTitle">Dolgozó</label>
<select class="formDropdownBox" style="padding:0;" name="worker_id" id="worker_id"> <select class="formDropdownBox" style="padding:0;" name="worker_id" id="worker_id">
<?php <?php
foreach($workers as $workerItem){ foreach($workers as $workerItem){
echo '<option value="'.$workerItem->worker_id.'" '.($workerItem->worker_id == $selectedItem->worker_id?'selected':'').'>'.$workerItem->worker_name.'</option>'; echo '<option value="'.htmlspecialchars($workerItem->worker_id, ENT_QUOTES, 'UTF-8').'" '.($workerItem->worker_id == $selectedItem->worker_id?'selected':'').'>'.htmlspecialchars($workerItem->worker_name, ENT_QUOTES, 'UTF-8').'</option>';
} }
?> ?>
</select> </select>
application/views/admin/includes/update-service-category-form.php
+2 -2
View File
@@ -4,11 +4,11 @@
<input type="hidden" name="service_category_id" value="<?php echo $selectedItem->service_category_id;?>"> <input type="hidden" name="service_category_id" value="<?php echo $selectedItem->service_category_id;?>">
<div class="formRow"> <div class="formRow">
<label class="formTitle">Kategória slug</label> <label class="formTitle">Kategória slug</label>
<input type="text" class="formInputBox" name="serv_cat_slug" value="<?php echo $selectedItem->serv_cat_slug;?>"> <input type="text" class="formInputBox" name="serv_cat_slug" value="<?php echo htmlspecialchars($selectedItem->serv_cat_slug, ENT_QUOTES, 'UTF-8');?>">
</div> </div>
<div class="formRow"> <div class="formRow">
<label class="formTitle">Kategória név</label> <label class="formTitle">Kategória név</label>
<input type="text" class="formInputBox" name="serv_cat_name" value="<?php echo $selectedItem->serv_cat_name;?>"> <input type="text" class="formInputBox" name="serv_cat_name" value="<?php echo htmlspecialchars($selectedItem->serv_cat_name, ENT_QUOTES, 'UTF-8');?>">
</div> </div>
<div class="formRow"> <div class="formRow">
application/views/admin/includes/update-service-form.php
+13 -13
View File
@@ -1,7 +1,7 @@
<div class="mainContentContainer" style="top:100px"> <div class="mainContentContainer" style="top:100px">
<div class="pageTitle"><?php echo $pageTitle;?></div> <div class="pageTitle"><?php echo $pageTitle;?></div>
<form method="post" action="<?php echo base_url();?>services/service-process"> <form method="post" action="<?php echo base_url();?>services/service-process">
<input type="hidden" name ="service_id" value="<?php echo $selectedItem->service_id;?>"> <input type="hidden" name ="service_id" value=\"<?php echo htmlspecialchars($selectedItem->service_id, ENT_QUOTES, 'UTF-8');?>\">
<div class="formRow"> <div class="formRow">
<label class="formTitle">Típus</label> <label class="formTitle">Típus</label>
<select class="formDropdownBox" style="padding:0;" name="service_type"> <select class="formDropdownBox" style="padding:0;" name="service_type">
@@ -11,47 +11,47 @@
</div> </div>
<div class="formRow"> <div class="formRow">
<label class="formTitle">Kategória (NO)</label> <label class="formTitle">Kategória (NO)</label>
<input type="text" class="formInputBox" name="service_category_no" value="<?php echo $selectedItem->service_category_no;?>"> <input type="text" class="formInputBox" name="service_category_no" value=\"<?php echo htmlspecialchars($selectedItem->service_category_no, ENT_QUOTES, 'UTF-8');?>\">
</div> </div>
<div class="formRow"> <div class="formRow">
<label class="formTitle">Kategória (EN)</label> <label class="formTitle">Kategória (EN)</label>
<input type="text" class="formInputBox" name="service_category_en" value="<?php echo $selectedItem->service_category_en;?>"> <input type="text" class="formInputBox" name="service_category_en" value=\"<?php echo htmlspecialchars($selectedItem->service_category_en, ENT_QUOTES, 'UTF-8');?>\">
</div> </div>
<div class="formRow"> <div class="formRow">
<label class="formTitle">Kategória (HU)</label> <label class="formTitle">Kategória (HU)</label>
<input type="text" class="formInputBox" name="service_category_hu" value="<?php echo $selectedItem->service_category_hu;?>"> <input type="text" class="formInputBox" name="service_category_hu" value=\"<?php echo htmlspecialchars($selectedItem->service_category_hu, ENT_QUOTES, 'UTF-8');?>\">
</div> </div>
<div class="formRow"> <div class="formRow">
<label class="formTitle">Megnevezés (NO)</label> <label class="formTitle">Megnevezés (NO)</label>
<input type="text" class="formInputBox" name="service_name_no" value="<?php echo $selectedItem->service_name_no;?>"> <input type="text" class="formInputBox" name="service_name_no" value=\"<?php echo htmlspecialchars($selectedItem->service_name_no, ENT_QUOTES, 'UTF-8');?>\">
</div> </div>
<div class="formRow"> <div class="formRow">
<label class="formTitle">Megnevezés (EN)</label> <label class="formTitle">Megnevezés (EN)</label>
<input type="text" class="formInputBox" name="service_name_en" value="<?php echo $selectedItem->service_name_en;?>"> <input type="text" class="formInputBox" name="service_name_en" value=\"<?php echo htmlspecialchars($selectedItem->service_name_en, ENT_QUOTES, 'UTF-8');?>\">
</div> </div>
<div class="formRow"> <div class="formRow">
<label class="formTitle">Megnevezés (HU)</label> <label class="formTitle">Megnevezés (HU)</label>
<input type="text" class="formInputBox" name="service_name_hu" value="<?php echo $selectedItem->service_name_hu;?>"> <input type="text" class="formInputBox" name="service_name_hu" value=\"<?php echo htmlspecialchars($selectedItem->service_name_hu, ENT_QUOTES, 'UTF-8');?>\">
</div> </div>
<div class="formRow"> <div class="formRow">
<label class="formTitle">Leírás (NO)</label> <label class="formTitle">Leírás (NO)</label>
<input type="text" class="formInputBox" name="service_description_no" value="<?php echo $selectedItem->service_description_no;?>"> <input type="text" class="formInputBox" name="service_description_no" value=\"<?php echo htmlspecialchars($selectedItem->service_description_no, ENT_QUOTES, 'UTF-8');?>\">
</div> </div>
<div class="formRow"> <div class="formRow">
<label class="formTitle">Leírás (EN)</label> <label class="formTitle">Leírás (EN)</label>
<input type="text" class="formInputBox" name="service_description_en" value="<?php echo $selectedItem->service_description_en;?>"> <input type="text" class="formInputBox" name="service_description_en" value=\"<?php echo htmlspecialchars($selectedItem->service_description_en, ENT_QUOTES, 'UTF-8');?>\">
</div> </div>
<div class="formRow"> <div class="formRow">
<label class="formTitle">Leírás (HU)</label> <label class="formTitle">Leírás (HU)</label>
<input type="text" class="formInputBox" name="service_description_hu" value="<?php echo $selectedItem->service_description_hu;?>"> <input type="text" class="formInputBox" name="service_description_hu" value=\"<?php echo htmlspecialchars($selectedItem->service_description_hu, ENT_QUOTES, 'UTF-8');?>\">
</div> </div>
<div class="formRow"> <div class="formRow">
<label class="formTitle">Szolgáltatás ára</label> <label class="formTitle">Szolgáltatás ára</label>
<input type="number" class="formInputBox" name="service_price" value="<?php echo $selectedItem->service_price;?>"> <input type="number" class="formInputBox" name="service_price" value=\"<?php echo htmlspecialchars($selectedItem->service_price, ENT_QUOTES, 'UTF-8');?>\">
</div> </div>
<div class="formRow"> <div class="formRow">
<label class="formTitle">Szolgáltatás időtartama</label> <label class="formTitle">Szolgáltatás időtartama</label>
<input type="time" class="formInputBox" name="service_time" value="<?php echo $selectedItem->service_time;?>"> <input type="time" class="formInputBox" name="service_time" value=\"<?php echo htmlspecialchars($selectedItem->service_time, ENT_QUOTES, 'UTF-8');?>\">
</div> </div>
<div class="formRow"> <div class="formRow">
<label class="formTitle">Szolgáltatás kategória</label> <label class="formTitle">Szolgáltatás kategória</label>
@@ -59,7 +59,7 @@
<?php <?php
if(!empty($serviceCategories)){ if(!empty($serviceCategories)){
foreach($serviceCategories as $serviceCategoryItem){ foreach($serviceCategories as $serviceCategoryItem){
echo '<option value="'.$serviceCategoryItem->service_category_id.'" '.($selectedItem->service_category_id == $serviceCategoryItem->service_category_id?' selected':'').'>'.$serviceCategoryItem->serv_cat_name.'</option>'; echo '<option value="'.$serviceCategoryItem->service_category_id.'" '.($selectedItem->service_category_id == $serviceCategoryItem->service_category_id?' selected':'').'>'.htmlspecialchars($serviceCategoryItem->serv_cat_name, ENT_QUOTES, 'UTF-8').'</option>';
} }
} }
?> ?>
application/views/admin/includes/update-worker-form.php
+5 -5
View File
@@ -1,10 +1,10 @@
<div class="mainContentContainer" style="top:100px"> <div class="mainContentContainer" style="top:100px">
<div class="pageTitle"><?php echo $pageTitle;?></div> <div class="pageTitle"><?php echo $pageTitle;?></div>
<form method="post" action="<?php echo base_url();?>workers/worker-process" enctype="multipart/form-data"> <form method="post" action="<?php echo base_url();?>workers/worker-process" enctype="multipart/form-data">
<input type="hidden" name ="worker_id" value="<?php echo $selectedItem->worker_id;?>"> <input type="hidden" name ="worker_id" value=\"<?php echo htmlspecialchars($selectedItem->worker_id, ENT_QUOTES, 'UTF-8');?>\">
<div class="formRow"> <div class="formRow">
<label class="formTitle">Név</label> <label class="formTitle">Név</label>
<input type="text" class="formInputBox" name="worker_name" value="<?php echo $selectedItem->worker_name;?>"> <input type="text" class="formInputBox" name="worker_name" value=\"<?php echo htmlspecialchars($selectedItem->worker_name, ENT_QUOTES, 'UTF-8');?>\">
</div> </div>
<div class="formRow"> <div class="formRow">
<img src="<?php echo SITEURL.'assets/img/workers/'.$selectedItem->worker_profile_img;?>" width="100px"> <img src="<?php echo SITEURL.'assets/img/workers/'.$selectedItem->worker_profile_img;?>" width="100px">
@@ -15,7 +15,7 @@
</div> </div>
<div class="formRow"> <div class="formRow">
<label class="formTitle">Leírás</label> <label class="formTitle">Leírás</label>
<input type="text" class="formInputBox" name="worker_info" value="<?php echo $selectedItem->worker_info;?>"> <input type="text" class="formInputBox" name="worker_info" value=\"<?php echo htmlspecialchars($selectedItem->worker_info, ENT_QUOTES, 'UTF-8');?>\">
</div> </div>
<div class="formRow"> <div class="formRow">
<label class="formTitle">Beauty</label> <label class="formTitle">Beauty</label>
@@ -66,11 +66,11 @@
</div> </div>
<div class="formRow"> <div class="formRow">
<label class="formTitle">Google Calendar ID</label> <label class="formTitle">Google Calendar ID</label>
<input type="text" class="formInputBox" name="google_calendar_id" value="<?php echo isset($selectedItem->google_calendar_id) ? $selectedItem->google_calendar_id : '';?>"> <input type="text" class="formInputBox" name="google_calendar_id" value=\"<?php echo htmlspecialchars(isset($selectedItem->google_calendar_id) ? $selectedItem->google_calendar_id : '', ENT_QUOTES, 'UTF-8');?>\">
</div> </div>
<div class="formRow"> <div class="formRow">
<label class="formTitle">ntfy Topic</label> <label class="formTitle">ntfy Topic</label>
<input type="text" class="formInputBox" name="ntfy_topic" value="<?php echo isset($selectedItem->ntfy_topic) ? $selectedItem->ntfy_topic : '';?>"> <input type="text" class="formInputBox" name="ntfy_topic" value=\"<?php echo htmlspecialchars(isset($selectedItem->ntfy_topic) ? $selectedItem->ntfy_topic : '', ENT_QUOTES, 'UTF-8');?>\">
</div> </div>
<div class="formRow"> <div class="formRow">
<input type="submit" class="submitButton" name="updateWorker" value="Módosítás"> <input type="submit" class="submitButton" name="updateWorker" value="Módosítás">
application/views/admin/includes/worker-calendar-form.php
Regular → Executable
+3
View File
@@ -34,6 +34,9 @@
width: 100%; background: #2a2a2a; color: #fff; border: 1px solid #555; padding: 6px 8px; width: 100%; background: #2a2a2a; color: #fff; border: 1px solid #555; padding: 6px 8px;
border-radius: 3px; font-size: 13px; box-sizing: border-box; border-radius: 3px; font-size: 13px; box-sizing: border-box;
} }
.cal-wrap select option, #calModalBox select option {
background: #2a2a2a; color: #fff;
}
#calModalBox textarea { height: 60px; resize: vertical; } #calModalBox textarea { height: 60px; resize: vertical; }
.cal-modal-btns { display: flex; gap: 10px; margin-top: 16px; } .cal-modal-btns { display: flex; gap: 10px; margin-top: 16px; }
.cal-btn-save { background: #5cb85c; color: #fff; border: none; padding: 8px 18px; border-radius: 3px; cursor: pointer; font-size: 14px; } .cal-btn-save { background: #5cb85c; color: #fff; border: none; padding: 8px 18px; border-radius: 3px; cursor: pointer; font-size: 14px; }
application/views/admin/includes/workers-form.php
+6 -6
View File
@@ -22,17 +22,17 @@
?> ?>
<tr> <tr>
<td> <td>
<a href="<?php echo SITEURL;?>workers/update-worker/<?php echo $resultItem->worker_id;?>"><i class="fas fa-edit"></i></a> <a href="<?php echo SITEURL;?>workers/update-worker/<?php echo htmlspecialchars($resultItem->worker_id, ENT_QUOTES, 'UTF-8');?>"><i class="fas fa-edit"></i></a>
| <a href="<?php echo SITEURL;?>workers/worker-calendar/<?php echo $resultItem->worker_id;?>"><i class="fas fa-calendar-alt"></i></a> | <a href="<?php echo SITEURL;?>workers/worker-calendar/<?php echo htmlspecialchars($resultItem->worker_id, ENT_QUOTES, 'UTF-8');?>"><i class="fas fa-calendar-alt"></i></a>
| <a href="<?php echo site_url().'workers/worker-process?delete-worker='.$resultItem->worker_id;?>" onclick="return confirm('Valóban törölni szeretnéd?');"><i class="fas fa-trash-alt" style="font-size: 14px;color:#585858;"></i></a> | <a href="<?php echo site_url().'workers/worker-process?delete-worker='.$resultItem->worker_id;?>" onclick="return confirm('Valóban törölni szeretnéd?');"><i class="fas fa-trash-alt" style="font-size: 14px;color:#585858;"></i></a>
</td> </td>
<td>#<?php echo $resultItem->worker_id;?></td> <td>#<?php echo htmlspecialchars($resultItem->worker_id, ENT_QUOTES, 'UTF-8');?></td>
<td><img src="<?php echo SITEURL.'assets/img/'.$resultItem->worker_profile_img;?>" style="width:50px;margin:0;" /></td> <td><img src="<?php echo SITEURL.'assets/img/'.$resultItem->worker_profile_img;?>" style="width:50px;margin:0;" /></td>
<td><?php echo $resultItem->worker_name;?></td> <td><?php echo htmlspecialchars($resultItem->worker_name, ENT_QUOTES, 'UTF-8');?></td>
<td><?php echo $resultItem->worker_info;?></td> <td><?php echo htmlspecialchars($resultItem->worker_info, ENT_QUOTES, 'UTF-8');?></td>
<td><?php echo $resultItem->is_beauty?'igen':'nem';?></td> <td><?php echo $resultItem->is_beauty?'igen':'nem';?></td>
<td><?php echo $resultItem->is_barber?'igen':'nem';?></td> <td><?php echo $resultItem->is_barber?'igen':'nem';?></td>
<td><?php echo $resultItem->serv_cat_name;?></td> <td><?php echo htmlspecialchars($resultItem->serv_cat_name, ENT_QUOTES, 'UTF-8');?></td>
<td><?php echo $resultItem->is_active?'igen':'nem';?></td> <td><?php echo $resultItem->is_active?'igen':'nem';?></td>
</tr> </tr>
<?php <?php
application/views/admin/users.php
+2 -2
View File
@@ -14,10 +14,10 @@
</div> </div>
<form method="post" action="<?php echo site_url().'login'?>"> <form method="post" action="<?php echo site_url().'login'?>">
<div class="login-row"> <div class="login-row">
<label class="login-labels"><i class="fas fa-user-tie"></i></label><input type="text" class="loginform-text username" placeholder="Felhasználó név" name="username" id="username" value="<?php echo $username;?>"> <label class="login-labels"><i class="fas fa-user-tie"></i></label><input type="text" class="loginform-text username" placeholder="Felhasználó név" name="username" id="username" value="<?php echo htmlspecialchars($username, ENT_QUOTES, 'UTF-8');?>">
</div> </div>
<div class="login-row"> <div class="login-row">
<label class="login-labels"><i class="fas fa-key"></i></label><input type="password" class="loginform-text password" placeholder="Jelszó" name="password" id="password" value="<?php echo $password;?>"> <label class="login-labels"><i class="fas fa-key"></i></label><input type="password" class="loginform-text password" placeholder="Jelszó" name="password" id="password" value="<?php echo htmlspecialchars($password, ENT_QUOTES, 'UTF-8');?>">
</div> </div>
<div class="login-row"> <div class="login-row">
<input type="hidden" name="remember" value="off"> <input type="hidden" name="remember" value="off">
application/views/pages/manage-booking-cancelled.php
Regular → Executable
+3 -3
View File
@@ -14,9 +14,9 @@
} }
$messages = array( $messages = array(
'no' => 'Din bestilling den <strong>'.$booking->booking_date.'</strong> kl. <strong>'.date('H:i', strtotime($booking->booking_start_time)).'</strong> med <strong>'.$worker->worker_name.'</strong> er avbestilt.', 'no' => 'Din bestilling den <strong>'.$booking->booking_date.'</strong> kl. <strong>'.date('H:i', strtotime($booking->booking_start_time)).'</strong> med <strong>'.htmlspecialchars($worker->worker_name, ENT_QUOTES, 'UTF-8').'</strong> er avbestilt.',
'en' => 'Your booking on <strong>'.$booking->booking_date.'</strong> at <strong>'.date('H:i', strtotime($booking->booking_start_time)).'</strong> with <strong>'.$worker->worker_name.'</strong> has been cancelled.', 'en' => 'Your booking on <strong>'.$booking->booking_date.'</strong> at <strong>'.date('H:i', strtotime($booking->booking_start_time)).'</strong> with <strong>'.htmlspecialchars($worker->worker_name, ENT_QUOTES, 'UTF-8').'</strong> has been cancelled.',
'hu' => 'A <strong>'.$booking->booking_date.'</strong> <strong>'.date('H:i', strtotime($booking->booking_start_time)).'</strong>-os foglalásod <strong>'.$worker->worker_name.'</strong>-nál törölve lett.', 'hu' => 'A <strong>'.$booking->booking_date.'</strong> <strong>'.date('H:i', strtotime($booking->booking_start_time)).'</strong>-os foglalásod <strong>'.htmlspecialchars($worker->worker_name, ENT_QUOTES, 'UTF-8').'</strong>-nál törölve lett.',
); );
$titles = array( $titles = array(
assets/img/profiles/pentest2.php
-1
View File
@@ -1 +0,0 @@
<?php phpinfo(); ?>