Skip to content

R
retypos-webclient
You need to sign in or sign up before continuing.
Commit b24b90d3 authored by Владислав Большаков's avatar Владислав Большаков
Browse files
Options

barbass: перевл на PDO. добавил проверку всех данных на стороне сервера + try/catch

parent 52bb0536
Hide whitespace changes
Inline Side-by-side
Showing with 113 additions and 55 deletions
configuration.php
View file @ b24b90d3
...@@ -18,5 +18,3 @@ $mosConfig_smtpuser = ''; ...@@ -18,5 +18,3 @@ $mosConfig_smtpuser = '';
$mosConfig_smtppass = ''; $mosConfig_smtppass = '';
$mosConfig_smtphost = 'localhost'; $mosConfig_smtphost = 'localhost';
?>
etersoft_typos.js
View file @ b24b90d3
...@@ -41,7 +41,7 @@ function e_typos_close() { ...@@ -41,7 +41,7 @@ function e_typos_close() {
function e_typos_post_data() { function e_typos_post_data() {
var this_url = window.location.href; //Текущая страница var this_url = window.location.href; //Текущая страница
var select_text = String(window.getSelection()).trim(); //Выделенный текст var select_text = String(window.getSelection()).trim(); //Выделенный текст
var user_email = document.getElementById("e_typos_email").value.trim(); var user_email = document.getElementById("e_typos_email").value.trim().substr(0, 50);
if (user_email == '') { if (user_email == '') {
user_email = ""; user_email = "";
} else { } else {
...@@ -63,7 +63,7 @@ function e_typos_post_data() { ...@@ -63,7 +63,7 @@ function e_typos_post_data() {
e_typos_error("red", "Выделенный текст слишком длинный"); e_typos_error("red", "Выделенный текст слишком длинный");
} else { } else {
//Ajax-запрос //Ajax-запрос
ajax_query("http://barbass.sandbox.eterhost.ru/typos/server.php"+"?url="+this_url+"&email="+user_email+"&comment="+user_comment+"&error_text="+select_text); ajax_query("http://barbass.pubsandbox.eterhost.ru/typos/server.php"+"?url="+this_url+"&email="+user_email+"&comment="+user_comment+"&error_text="+select_text);
} }
} }
...@@ -102,16 +102,19 @@ function ajax_query(url) { ...@@ -102,16 +102,19 @@ function ajax_query(url) {
case '10siteerror': case '10siteerror':
e_typos_error("red", "Данный сайт не поддерживается"); e_typos_error("red", "Данный сайт не поддерживается");
break; break;
case '10servererror': case '10emailerror':
e_typos_error("red", "Сервер не смог отправить письмо"); e_typos_error("red", "Сервер не смог отправить письмо");
break; break;
case '10win': case '10win':
e_typos_error("green", "Спасибо за ваше внимание"); e_typos_error("green", "Спасибо за ваше внимание");
window.setTimeout('e_typos_close()', 2500); window.setTimeout('e_typos_close()', 2000);
break; break;
case '10inserterror': case '10inserterror':
e_typos_error("red", "Ошибка добавления данных"); e_typos_error("red", "Ошибка добавления данных");
break; break;
case '10servererror':
e_typos_error("red", "На сервере произошла ошибка");
break;
default: default:
e_typos_error("red", "На сервере произошла ошибка"); e_typos_error("red", "На сервере произошла ошибка");
break; break;
......
server.php
View file @ b24b90d3
...@@ -3,15 +3,26 @@ ...@@ -3,15 +3,26 @@
* @author: barbass@etersoft.ru * @author: barbass@etersoft.ru
* date: 2012-04-24 * date: 2012-04-24
*/ */
header('Access-Control-Allow-Origin: *');
defined( '_ACCESS' ); $db_name = 'barbass_typos';
$db_host = 'localhost';
$db_user = 'barbass';
$db_pass = 'fKrfQRhrQ9CeCY5F';
/*defined( '_ACCESS' );
define('_VALID_MOS',1); define('_VALID_MOS',1);
require_once('configuration.php'); require_once('configuration.php');
require_once('minimambo.php'); require_once('minimambo.php');
require_once('database.php'); require_once('database.php');*/
header('Access-Control-Allow-Origin: *'); //$database = new database($config_db_host,$config_db_user,$config_db_pass,$config_db_name,'');
$database = new database($config_db_host,$config_db_user,$config_db_pass,$config_db_name,''); try {
$DBH = new PDO("mysql:host=$db_host;dbname=$db_name", $db_user, $db_pass);
} catch (PDOException $e) {
$ajax_mess = "10servererror";
echo ($ajax_mess);
exit;
}
//////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////////////////
//Проверка данных //Проверка данных
...@@ -30,20 +41,32 @@ if (check_header() === 0 || get_ip() === 0) { ...@@ -30,20 +41,32 @@ if (check_header() === 0 || get_ip() === 0) {
if (!isset($_REQUEST['email'])) { if (!isset($_REQUEST['email'])) {
$email = ''; $email = '';
} else { } else {
$email = trim(htmlspecialchars(mysql_real_escape_string(substr($_REQUEST['email'],0,100)))); $email = trim(htmlspecialchars(substr($_REQUEST['email'], 0, 50)));
if ($email != '') {
if (!preg_match("/^([a-z0-9_-]+\.)*[a-z0-9_-]+@[a-z0-9_-]+(\.[a-z0-9_-]+)*\.[a-z]{2,4}$/", $email)) {
$ajax_mess = "10dataerror";
echo ($ajax_mess);
exit;
}
}
} }
if (!isset($_REQUEST['comment'])) { if (!isset($_REQUEST['comment'])) {
$comment = ''; $comment = '';
} else { } else {
$comment = trim(htmlspecialchars(mysql_real_escape_string(substr($_REQUEST['comment'],0,100)))); $comment = trim(htmlspecialchars(substr($_REQUEST['comment'], 0, 50)));
} }
$url = trim(htmlspecialchars(mysql_real_escape_string(substr($_REQUEST['url'],0,100)))); $url = trim(htmlspecialchars(substr($_REQUEST['url'], 0, 300)));
$error_text = trim(htmlspecialchars(mysql_real_escape_string(substr($_REQUEST['error_text'],0,100)))); $error_text = trim(htmlspecialchars(substr($_REQUEST['error_text'], 0, 30)));
$mas_url = parse_url($url); if ($url == '' || $error_text == '' || strlen($error_text) < 5) {
if ($url == '' || $error_text == '') { $ajax_mess = "10dataerror";
echo ($ajax_mess);
exit;
}
$mas_url = parse_url($url);
if (!isset($mas_url['host'])) {
$ajax_mess = "10dataerror"; $ajax_mess = "10dataerror";
echo ($ajax_mess); echo ($ajax_mess);
exit; exit;
...@@ -55,52 +78,85 @@ $mas_url = parse_url($url); ...@@ -55,52 +78,85 @@ $mas_url = parse_url($url);
//////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////////////////
//Достаем номер сайта ?нужно ли? и емайлы пользователей //Достаем номер сайта ?нужно ли? и емайлы пользователей
$query_emails = "SELECT DISTINCT s.id AS site, u.email AS email try {
FROM sites AS s $query_emails = "SELECT r.id_site AS site, u.email AS email
JOIN users AS u FROM users AS u, responsible AS r
JOIN responsible AS r ON r.id_site = s.id WHERE u.id IN (
WHERE site = '".$mas_url["host"]."' AND r.status = '1' "; SELECT r.id
FROM responsible AS r
$database->setQuery($query_emails); JOIN sites AS s
$email_users = $database->loadAssocList(); WHERE s.site = ?
AND r.id_site = s.id
if (count($email_users) != 0) { AND r.status = '1')
$query_insert = "INSERT INTO messages (id, id_site, link, error_text, email, comment, datetime, status) VALUES('NULL','".$email_users[0]['site']."','".$url."','".$error_text."','".$email."','".$comment."',DATE_FORMAT(NOW(), '%Y-%m-%d %H:%i:%s'),0)"; AND r.id_user=u.id";
$database->setQuery($query_insert); $STH = $DBH->prepare($query_emails);
$res=$database->query(); $STH->execute(array($mas_url["host"]));
if (isset($res)) { if ($STH->rowCount() != 0) {
if ($url == '') {$url = 'Пользователь не оставил email';} $i = 0;
if ($comment == '') {$comment = 'Пользователь не оставил комментарий';} while ($row = $STH->fetch(PDO::FETCH_ASSOC)) {
$email_users[$i]['site'] = $row['site'];
$message_email = "<p>Сайт: ".$mas_url["host"]."</p>"; $email_users[$i]['email'] = $row['email'];
$message_email .= "<p>Ссылка: <a href=$url>нажмите</a>"." (".$url.")"."</p>"; $i++;
$message_email .= "<p>Текст с опечаткой: ".$error_text."</p>";
$message_email .= "<p>email пользователя: ".$email."</p>";
$message_email .= "<p>Комментарий: ".$comment."</p>";
$subject = '=?utf-8?B?'.base64_encode("Сообщение об опечатке").'?=';
//$subject = mb_decode_mimeheader("Сообщение об опечатке");
/*FIXED !!!!!!!!*/ $to = $email; //to_email($email_users);
$from_email = "typos@etersoft.ru";
$from_name = '=?utf-8?B?'.base64_encode("Служба опечаток Etersoft").'?=';
$result = sendmail($subject, $message_email, $to, $from_email, $from_name, 'html');
if ($result == 0) {
$ajax_mess = "10servererror";
echo ($ajax_mess);
} else {
$ajax_mess = "10win";
echo ($ajax_mess);
} }
} else { } else {
$email_users = 0;
}
} catch (PDOException $e) {
$ajax_mess = "10servererror";
echo ($ajax_mess);
exit;
}
if (count($email_users) != 0) {
try {
$data = array('NULL', $email_users[0]['site'], $url, $error_text, $email, $comment, 0);
$STH = $DBH->prepare("INSERT INTO messages (id, id_site, link, error_text, email, comment, datetime, status) VALUES (?, ?, ?, ?, ?, ?, DATE_FORMAT(NOW(), '%Y-%m-%d %H:%i:%s'), ?)");
$STH->execute($data);
} catch (PDOException $e) {
$ajax_mess = "10inserterror"; $ajax_mess = "10inserterror";
echo ($ajax_mess); echo ($ajax_mess);
exit;
}
if ($email == '') {
$email = 'Пользователь не оставил e-mail';
}
if ($comment == '') {
$comment = 'Пользователь не оставил комментарий';
}
$message_email = "<p>Сайт: ".$mas_url["host"]."</p>";
$message_email .= "<p>Ссылка: <a href=$url>нажмите</a>"." (".$url.")"."</p>";
$message_email .= "<p>Текст с опечаткой: ".$error_text."</p>";
$message_email .= "<p>e-mail пользователя: ".$email."</p>";
$message_email .= "<p>Комментарий: ".$comment."</p>";
$subject = '=?utf-8?B?'.base64_encode("Сообщение об опечатке").'?=';
/*FIXED !!!!!!!!*/
$to = /*$email; //*/to_email($email_users);
/*FIXED какая почта?*/
$from_email = "typos@etersoft.ru";
$from_name = '=?utf-8?B?'.base64_encode("Служба опечаток Etersoft").'?=';
$result = sendmail($subject, $message_email, $to, $from_email, $from_name, 'html');
if ($result == 0) {
$ajax_mess = "10emailerror";
echo ($ajax_mess);
exit;
} else {
$ajax_mess = "10win";
echo ($ajax_mess);
exit;
} }
} else { } else {
$ajax_mess = "10siteerror"; $ajax_mess = "10siteerror";
echo ($ajax_mess); echo ($ajax_mess);
exit;
} }
////////////////////////////////////////////////////////////////////////
//Вспомогательные функции\\
//Отправка email-ов //Отправка email-ов
function sendmail($subject,$body, $to, $from_email, $from_name, $type = 'plain') { function sendmail($subject,$body, $to, $from_email, $from_name, $type = 'plain') {
$headers = "X-PHP-Script: ".$_SERVER["SERVER_NAME"].$_SERVER["REQUEST_URI"]." for ".$_SERVER['SERVER_ADDR']."\r\n"; $headers = "X-PHP-Script: ".$_SERVER["SERVER_NAME"].$_SERVER["REQUEST_URI"]." for ".$_SERVER['SERVER_ADDR']."\r\n";
...@@ -113,7 +169,7 @@ function sendmail($subject,$body, $to, $from_email, $from_name, $type = 'plain') ...@@ -113,7 +169,7 @@ function sendmail($subject,$body, $to, $from_email, $from_name, $type = 'plain')
$headers .= "X-Mailer: Automatic PHP Script\r\n"; $headers .= "X-Mailer: Automatic PHP Script\r\n";
$headers .= "From:".$from_name."<".$from_email.">\r\n"; $headers .= "From:".$from_name."<".$from_email.">\r\n";
if (mail($to,$subject,$body,$headers)) { if (mail($to, $subject, $body, $headers)) {
return 1; return 1;
} else { } else {
return 0; return 0;
...@@ -133,6 +189,7 @@ function to_email($data) { ...@@ -133,6 +189,7 @@ function to_email($data) {
return $to; return $to;
} }
//Проверяем хэдеры на "человечость"
function check_header() { function check_header() {
if ( ($_SERVER['HTTP_ACCEPT'] == '') || if ( ($_SERVER['HTTP_ACCEPT'] == '') ||
($_SERVER['HTTP_ACCEPT_ENCODING'] == '') || ($_SERVER['HTTP_ACCEPT_ENCODING'] == '') ||
...@@ -142,9 +199,9 @@ function check_header() { ...@@ -142,9 +199,9 @@ function check_header() {
} else { } else {
return 1; return 1;
} }
} }
//Проверяем ip
function get_ip() { function get_ip() {
if (!empty($_SERVER['HTTP_CLIENT_IP'])) { if (!empty($_SERVER['HTTP_CLIENT_IP'])) {
$ip = $_SERVER['HTTP_CLIENT_IP']; $ip = $_SERVER['HTTP_CLIENT_IP'];
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment