Skip to content

Commit 387ffac

Browse files
HackmastrHackmastr
committed
Fix #809 
1 parent 7aaddaa commit 387ffac

File tree

2 files changed

+94
-32
lines changed

2 files changed

+94
-32
lines changed

‎web/includes/Log.php

Lines changed: 69 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -53,14 +53,47 @@ public static function add($type, $title, $message): void
5353
* @param string $search Entire "WHERE" statement including the word WHERE
5454
* @return mixed
5555
*/
56-
public static function getAll($start, $limit, $search): mixed
56+
public static function getAll($start, $limit): mixed
5757
{
58+
$where = '';
59+
$valueOther = null;
60+
$value = $_GET['advSearch'];
61+
$type = $_GET['advType'];
62+
63+
switch ($type) {
64+
case "admin":
65+
$where = " l.aid = :value";
66+
break;
67+
case "message":
68+
$value = "%$value%";
69+
$where = " l.message LIKE :value OR l.title LIKE :value";
70+
break;
71+
case "date":
72+
$date = explode(",", $value);
73+
$date[0] = (is_numeric($date[0])) ? $date[0] : date('d');
74+
$date[1] = (is_numeric($date[1])) ? $date[1] : date('m');
75+
$date[2] = (is_numeric($date[2])) ? $date[2] : date('Y');
76+
$value = mktime($date[3], $date[4], 0, (int)$date[1], (int)$date[0], (int)$date[2]);
77+
$valueOther = mktime($date[5], $date[6], 59, (int)$date[1], (int)$date[0], (int)$date[2]);
78+
$where = " l.created > :value AND l.created :valueOther";
79+
break;
80+
case "type":
81+
$where = " l.type = :value";
82+
break;
83+
}
84+
5885
$query = "SELECT ad.user, l.* FROM `:prefix_log` AS l
5986
LEFT JOIN `:prefix_admins` AS ad ON l.aid = ad.aid
60-
:search ORDER BY l.created DESC
87+
WHERE $where
88+
ORDER BY l.created DESC
6189
LIMIT :start, :lim";
62-
$query = str_replace(':search', filter_var($search, FILTER_SANITIZE_SPECIAL_CHARS, FILTER_FLAG_NO_ENCODE_QUOTES), $query);
63-
self::$dbs->query($query);
90+
91+
self::$dbs->query($query)
92+
->bind('value', $value);
93+
94+
if ($valueOther !== null)
95+
self::$dbs->bind('valueOther', $valueOther);
96+
6497
self::$dbs->bind(':start', (int)$start, PDO::PARAM_INT);
6598
self::$dbs->bind(':lim', (int)$limit, PDO::PARAM_INT);
6699
return self::$dbs->resultset();
@@ -72,9 +105,38 @@ public static function getAll($start, $limit, $search): mixed
72105
*/
73106
public static function getCount($search): mixed
74107
{
75-
$query = "SELECT COUNT(l.lid) AS count FROM `:prefix_log` AS l :search";
76-
$query = str_replace(':search', filter_var($search, FILTER_SANITIZE_SPECIAL_CHARS, FILTER_FLAG_NO_ENCODE_QUOTES), $query);
77-
self::$dbs->query($query);
108+
$value = $_GET['advSearch'];
109+
$valueOther = null;
110+
$type = $_GET['advType'];
111+
$query = "SELECT COUNT(l.lid) AS count FROM `:prefix_log` AS l WHERE ";
112+
switch ($type) {
113+
case "admin":
114+
$query .= " l.aid = :value";
115+
break;
116+
case "message":
117+
$value = "%$value%";
118+
$query .= " l.message LIKE :value OR l.title LIKE :value";
119+
break;
120+
case "date":
121+
$date = explode(",", $value);
122+
$date[0] = (is_numeric($date[0])) ? $date[0] : date('d');
123+
$date[1] = (is_numeric($date[1])) ? $date[1] : date('m');
124+
$date[2] = (is_numeric($date[2])) ? $date[2] : date('Y');
125+
$value = mktime($date[3], $date[4], 0, (int)$date[1], (int)$date[0], (int)$date[2]);
126+
$valueOther = mktime($date[5], $date[6], 59, (int)$date[1], (int)$date[0], (int)$date[2]);
127+
$query .= " l.created > :value AND l.created :valueOther";
128+
break;
129+
case "type":
130+
$query .= " l.type = :value";
131+
break;
132+
}
133+
134+
self::$dbs->query($query)
135+
->bind('value', $value);
136+
137+
if ($valueOther !== null)
138+
self::$dbs->bind('valueOther', $valueOther);
139+
78140
$log = self::$dbs->single();
79141
return $log['count'];
80142
}

‎web/pages/admin.settings.php

Lines changed: 25 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -49,30 +49,30 @@
4949
// Escape the value, but strip the leading and trailing quote
5050
$value = substr($GLOBALS['db']->qstr($_GET['advSearch']), 1, -1);
5151
$type = $_GET['advType'];
52-
switch ($type) {
53-
case "admin":
54-
$where = " WHERE l.aid = '" . $value . "'";
55-
break;
56-
case "message":
57-
$where = " WHERE l.message LIKE '%" . $value . "%' OR l.title LIKE '%" . $value . "%'";
58-
break;
59-
case "date":
60-
$date = explode(",", $value);
61-
$date[0] = (is_numeric($date[0])) ? $date[0] : date('d');
62-
$date[1] = (is_numeric($date[1])) ? $date[1] : date('m');
63-
$date[2] = (is_numeric($date[2])) ? $date[2] : date('Y');
64-
$time = mktime($date[3], $date[4], 0, (int)$date[1], (int)$date[0], (int)$date[2]);
65-
$time2 = mktime($date[5], $date[6], 59, (int)$date[1], (int)$date[0], (int)$date[2]);
66-
$where = " WHERE l.created > '$time' AND l.created < '$time2'";
67-
break;
68-
case "type":
69-
$where = " WHERE l.type = '" . $value . "'";
70-
break;
71-
default:
72-
$_GET['advType'] = "";
73-
$_GET['advSearch'] = "";
74-
break;
75-
}
52+
// switch ($type) {
53+
// case "admin":
54+
// $where = " WHERE l.aid = '" . $value . "'";
55+
// break;
56+
// case "message":
57+
// $where = " WHERE l.message LIKE '%" . $value . "%' OR l.title LIKE '%" . $value . "%'";
58+
// break;
59+
// case "date":
60+
// $date = explode(",", $value);
61+
// $date[0] = (is_numeric($date[0])) ? $date[0] : date('d');
62+
// $date[1] = (is_numeric($date[1])) ? $date[1] : date('m');
63+
// $date[2] = (is_numeric($date[2])) ? $date[2] : date('Y');
64+
// $time = mktime($date[3], $date[4], 0, (int)$date[1], (int)$date[0], (int)$date[2]);
65+
// $time2 = mktime($date[5], $date[6], 59, (int)$date[1], (int)$date[0], (int)$date[2]);
66+
// $where = " WHERE l.created > '$time' AND l.created < '$time2'";
67+
// break;
68+
// case "type":
69+
// $where = " WHERE l.type = '" . $value . "'";
70+
// break;
71+
// default:
72+
// $_GET['advType'] = "";
73+
// $_GET['advSearch'] = "";
74+
// break;
75+
// }
7676
$searchlink = "&advSearch=" . $_GET['advSearch'] . "&advType=" . $_GET['advType'];
7777
} else {
7878
$searchlink = "";
@@ -81,7 +81,7 @@
8181
$list_end = $list_start + SB_BANS_PER_PAGE;
8282

8383
$log_count = Log::getCount($where);
84-
$log = Log::getAll($list_start, SB_BANS_PER_PAGE, $where);
84+
$log = Log::getAll($list_start, SB_BANS_PER_PAGE,);
8585
if (($page > 1)) {
8686
$prev = CreateLinkR('<i class="fas fa-arrow-left fa-lg"></i> prev', "index.php?p=admin&c=settings" . $searchlink . "&page=" . ($page - 1) . "#^2");
8787
} else {

0 commit comments

Comments
 (0)