dbxe/fusionpbx
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Update destinations.php (#4265)

Browse Source 
* Update destinations.php

* Update destinations.php
This commit is contained in:
AlexanderDCrane
2019-06-06 18:55:59 -06:00
committed by FusionPBX
parent fa3f2117d4
commit 6af9f3bcbd
1 changed files with 39 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/destinations/destinations.php
+39 -29
View File
@@ -68,6 +68,21 @@
$order_by = check_str($_GET["order_by"]); $order_by = check_str($_GET["order_by"]);
$order = check_str($_GET["order"]); $order = check_str($_GET["order"]);
//validate order by
if (strlen($order_by) > 0) {
$order_by = preg_replace('#[^a-zA-Z0-9_\-]#', '', $order_by);
}
//validate the order
switch ($order) {
case 'asc':
break;
case 'desc':
break;
default:
$order = '';
}
//set the type //set the type
if ($_GET['type'] == 'inbound') { if ($_GET['type'] == 'inbound') {
$destination_type = 'inbound'; $destination_type = 'inbound';
@@ -86,16 +101,16 @@
$search = strtolower(check_str($_GET["search"])); $search = strtolower(check_str($_GET["search"]));
if (strlen($search) > 0) { if (strlen($search) > 0) {
$sql_search = " ("; $sql_search = " (";
$sql_search .= "lower(destination_type) like '%".$search."%' "; $sql_search .= "lower(destination_type) like :search ";
$sql_search .= "or lower(destination_number) like '%".$search."%' "; $sql_search .= "or lower(destination_number) like :search ";
$sql_search .= "or lower(destination_context) like '%".$search."%' "; $sql_search .= "or lower(destination_context) like :search ";
$sql_search .= "or lower(destination_accountcode) like '%".$search."%' "; $sql_search .= "or lower(destination_accountcode) like :search ";
if (permission_exists('outbound_caller_id_select')) { if (permission_exists('outbound_caller_id_select')) {
$sql_search .= "or lower(destination_caller_id_name) like '%".$search."%' "; $sql_search .= "or lower(destination_caller_id_name) like :search ";
$sql_search .= "or destination_caller_id_number like '%".$search."%' "; $sql_search .= "or destination_caller_id_number like :search ";
} }
$sql_search .= "or lower(destination_enabled) like '%".$search."%' "; $sql_search .= "or lower(destination_enabled) like :search ";
$sql_search .= "or lower(destination_description) like '%".$search."%' "; $sql_search .= "or lower(destination_description) like :search ";
$sql_search .= ") "; $sql_search .= ") ";
} }
@@ -105,27 +120,22 @@
//prepare to page the results //prepare to page the results
$sql = "select count(destination_uuid) as num_rows from v_destinations "; $sql = "select count(destination_uuid) as num_rows from v_destinations ";
$sql .= "where destination_type = '".$destination_type."' "; $sql .= "where destination_type = :destination_type ";
if ($_GET['show'] == "all" && permission_exists('destination_all')) { if ($_GET['show'] == "all" && permission_exists('destination_all')) {
//show all //show all
} else { } else {
$sql .= "and (domain_uuid = '".$domain_uuid."' or domain_uuid is null) "; $sql .= "and (domain_uuid = :domain_uuid or domain_uuid is null) ";
} }
if (isset($sql_search)) { if (isset($sql_search)) {
$sql .= "and ".$sql_search; $sql .= "and ".$sql_search;
} }
if (strlen($order_by)> 0) { $sql .= "order by $order_by $order "; } $parameters['destination_type'] = $destination_type;
$prep_statement = $db->prepare($sql); $parameters['domain_uuid'] = $domain_uuid;
if ($prep_statement) { if (strlen($search) > 0) {
$prep_statement->execute(); $parameters['search'] = '%'.$search.'%';
$row = $prep_statement->fetch(PDO::FETCH_ASSOC);
if ($row['num_rows'] > 0) {
$num_rows = $row['num_rows'];
}
else {
$num_rows = '0';
}
} }
$database = new database;
$num_rows = $database->select($sql, $parameters, 'column');
//prepare to page the results //prepare to page the results
$rows_per_page = ($_SESSION['domain']['paging']['numeric'] != '') ? $_SESSION['domain']['paging']['numeric'] : 50; $rows_per_page = ($_SESSION['domain']['paging']['numeric'] != '') ? $_SESSION['domain']['paging']['numeric'] : 50;
@@ -140,22 +150,22 @@
//get the list //get the list
$sql = "select * from v_destinations "; $sql = "select * from v_destinations ";
$sql .= "where destination_type = '".$destination_type."' "; $sql .= "where destination_type = :destination_type ";
if ($_GET['show'] == "all" && permission_exists('destination_all')) { if ($_GET['show'] == "all" && permission_exists('destination_all')) {
//show all //show all
} else { } else {
$sql .= "and (domain_uuid = '".$domain_uuid."' or domain_uuid is null) "; $sql .= "and (domain_uuid = :domain_uuid or domain_uuid is null) ";
} }
if (isset($sql_search)) { if (isset($sql_search)) {
$sql .= "and ".$sql_search; $sql .= "and ".$sql_search;
} }
$sql .= "and destination_type = '".$destination_type."' "; $sql .= "and destination_type = :destination_type ";
if (strlen($order_by)> 0) { $sql .= "order by $order_by $order "; } if (strlen($order_by)> 0) { $sql .= "order by $order_by $order "; }
$sql .= "limit $rows_per_page offset $offset "; $sql .= "limit :rows_per_page offset :offset ";
$prep_statement = $db->prepare(check_sql($sql)); $parameters['rows_per_page'] = $rows_per_page;
$prep_statement->execute(); $parameters['offset'] = $offset;
$destinations = $prep_statement->fetchAll(PDO::FETCH_NAMED); $database = new database;
unset ($prep_statement, $sql); $destinations = $database->select($sql, $parameters, 'all');
//get the destination select list //get the destination select list
$destination = new destinations; $destination = new destinations;