UbuntuandClaude Opus 4.6
420bcb37fd
- Fix all SQL injection vulnerabilities across Service_model, User_model, Module_model, Log_model, and Admin controller using parameterized queries - Add htmlspecialchars() to all user-controlled output in admin views (bookings, services, workers, service categories, login form) - Fix XSS in AJAX worker response and manage-booking-cancelled view - Add file extension whitelist (jpg, jpeg, png, gif, webp) to all uploads - Remove webshell (pentest2.php) from assets/img/profiles/ - Stop logging plaintext passwords on failed login attempts - Migrate database.php hostname from localhost to AWS RDS endpoint - Fix dropdown styling (white-on-white) in worker calendar view Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
94 lines
5.0 KiB
PHP
Executable File
94 lines
5.0 KiB
PHP
Executable File
<div class="mainContentContainer" style="top:100px">
|
|
<div class="pageTitle"><?php echo $pageTitle;?></div>
|
|
<div class="form-row">
|
|
<a href="<?php echo SITEURL;?>bookings/add-booking" class="submitBtn">Új foglalás</a>
|
|
</div>
|
|
<div class="form-row">
|
|
<select id="booking-filter" class="formDropdownBox" style="padding:0">
|
|
<option value="">Minden</option>
|
|
<?php
|
|
foreach($workers as $workerItem){
|
|
echo '<option value="'.$workerItem->worker_id.'" '.(isset($_GET['worker']) && $_GET['worker'] == $workerItem->worker_id?' selected':'').'>'.$workerItem->worker_name.'</option>';
|
|
}
|
|
?>
|
|
</select>
|
|
</div>
|
|
<div class="form-row">
|
|
<table class="tableClass">
|
|
<tr>
|
|
<td></td>
|
|
<td>#</td>
|
|
<td>Vendég neve</td>
|
|
<td>Email</td>
|
|
<td>Telefon</td>
|
|
<td>Dolgozó</td>
|
|
<td>Foglalási dátum</td>
|
|
<td>Szolg. kezdete</td>
|
|
<td>Szolg. vége</td>
|
|
<td>Szolgáltatások</td>
|
|
</tr>
|
|
<?php
|
|
if(is_array($results)){
|
|
foreach($results as $resultItem){
|
|
?>
|
|
<tr>
|
|
<td>
|
|
<a href="<?php echo SITEURL;?>bookings/update-booking/<?php echo $resultItem->booking_id ;?>"><i class="fas fa-edit"></i></a>
|
|
| <a href="<?php echo site_url().'bookings/booking-process?delete-booking='.$resultItem->booking_id;?>" onclick="return confirm('Valóban törölni szeretnéd?');"><i class="fas fa-trash-alt" style="font-size: 14px;color:#585858;"></i></a>
|
|
</td>
|
|
<td>#<?php echo htmlspecialchars($resultItem->booking_id, ENT_QUOTES, 'UTF-8');?></td>
|
|
<td><?php echo htmlspecialchars($resultItem->guest_name, ENT_QUOTES, 'UTF-8');?></td>
|
|
<td><?php echo htmlspecialchars($resultItem->guest_email, ENT_QUOTES, 'UTF-8');?></td>
|
|
<td><?php echo htmlspecialchars($resultItem->guest_phone, ENT_QUOTES, 'UTF-8');?></td>
|
|
<td><?php echo htmlspecialchars($resultItem->worker_name, ENT_QUOTES, 'UTF-8');?></td>
|
|
<td style="min-width:85px;"><?php echo htmlspecialchars($resultItem->booking_date, ENT_QUOTES, 'UTF-8');?></td>
|
|
<td><?php echo htmlspecialchars($resultItem->booking_start_time, ENT_QUOTES, 'UTF-8');?></td>
|
|
<td><?php echo htmlspecialchars($resultItem->booking_finish_time, ENT_QUOTES, 'UTF-8');?></td>
|
|
<td><?php
|
|
if(!empty($resultItem->services)){
|
|
echo '<table class="tableInTable">';
|
|
echo '<tr>';
|
|
echo '<td>Típus</td>';
|
|
echo '<td>Szolgáltalás neve</td>';
|
|
echo '<td>Ár</td>';
|
|
echo '<td>Időtartam</td>';
|
|
echo '</tr>';
|
|
foreach($resultItem->services as $serviceItem){
|
|
echo '<tr>';
|
|
echo '<td>'.htmlspecialchars($serviceItem->service_type, ENT_QUOTES, 'UTF-8').'</td>';
|
|
echo '<td>'.htmlspecialchars($serviceItem->service_name, ENT_QUOTES, 'UTF-8').'</td>';
|
|
echo '<td>'.htmlspecialchars($serviceItem->service_price, ENT_QUOTES, 'UTF-8').'</td>';
|
|
echo '<td>'.htmlspecialchars($serviceItem->service_time, ENT_QUOTES, 'UTF-8').'</td>';
|
|
echo '</tr>';
|
|
}
|
|
echo '</table>';
|
|
}
|
|
|
|
?></td>
|
|
</tr>
|
|
<?php
|
|
}
|
|
}
|
|
else{
|
|
echo '<tr>';
|
|
echo '<td colspan="10">Nincs bejegyzett foglalás</td>';
|
|
echo '</tr>';
|
|
}
|
|
?>
|
|
|
|
</table>
|
|
</div>
|
|
</div>
|
|
|
|
<script>
|
|
$(document).ready(function(){
|
|
$('#booking-filter').change(function(){
|
|
if($('#booking-filter').val() != ''){
|
|
$(location).attr('href', '<?php SITEURL;?>bookings?worker='+$('#booking-filter').val());
|
|
}
|
|
else{
|
|
$(location).attr('href', '<?php SITEURL;?>bookings');
|
|
}
|
|
});
|
|
});
|
|
</script>
|