pcwvanbeers/assetmgt
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Hardening

Browse Source
This commit is contained in:
“VeLiTi”
2025-08-20 19:24:03 +02:00
parent 41200633cb
commit 010b23b0e5
19 changed files with 1358 additions and 59 deletions
Download Patch File Download Diff File Expand all files Collapse all files

BIN
.DS_Store vendored
View File

Binary file not shown.

BIN
api/.DS_Store vendored
View File

Binary file not shown.

BIN
api/v0/.DS_Store vendored
View File

Binary file not shown.

4
api/v0/authorization.php
View File

@@ -60,12 +60,12 @@ if (!empty($username) && !empty($password)) {
}
else
{
http_response_code(203);
http_response_code(403);
}
}
}
else {
http_response_code(203);
http_response_code(403);
}
$conn->close();
}

BIN
api/v1/.DS_Store vendored
View File

Binary file not shown.

3
api/v1/get/application.php
View File

@@ -188,7 +188,8 @@ switch ($action) {
break;
case 'report_usage_servicereports':
$sql = 'SELECT YEAR(h.created) AS year, QUARTER(h.created) AS quarter, MONTH(h.created) as month, count(h.rowID) AS count FROM equipment_history h LEFT JOIN equipment e ON h.equipmentid = e.rowID where h.type = "ServiceReport" AND NOT e.productrowid = "31" GROUP BY YEAR(h.created), QUARTER(h.created), MONTH(h.created)';
$exclusion = ' AND NOT e.serialnumber = "22050695" AND NOT e.serialnumber = "22020439" AND NOT e.serialnumber = "23060550" AND NOT e.serialnumber = "22020444" ';
$sql = 'SELECT YEAR(h.created) AS year, QUARTER(h.created) AS quarter, MONTH(h.created) as month, count(h.rowID) AS count FROM equipment_history h LEFT JOIN equipment e ON h.equipmentid = e.rowID where h.type = "ServiceReport" AND NOT e.productrowid = "31" '.$exclusion.' GROUP BY YEAR(h.created), QUARTER(h.created), MONTH(h.created)';
break;
case 'contract_usage_servicereports':

2
api/v1/get/history.php
View File

@@ -68,7 +68,7 @@ if(isset($get_content) && $get_content!=''){
//Filter out only relevant servicereports
$filter_key_1 = '"%serialnumber%"';
$filter_key_2 = '"ServiceReport"';
$clause .= ' AND h.type = '.$filter_key_2.' AND h.description like '.$filter_key_1;
$clause .= ' AND h.type = '.$filter_key_2.' AND e.productrowid = "31" AND h.description like '.$filter_key_1;
}
else {//create clause
$clause .= ' AND '.$v[0].' = :'.$v[0];

BIN
api/v2/.DS_Store vendored Normal file
View File

Binary file not shown.

5
api/v2/get/catalog.php
View File

@@ -80,12 +80,15 @@ foreach ($products as $product) {
$version_configurations = [];
foreach ($product_config as $item) {
if ($item['productrowid'] == $product['rowID']) {
// Initialize version array if it doesn't exist
if (!isset($version_configurations[$item['version']])) {
$version_configurations[$item['version']] = [
'version_id' => $item['version'],
'config_setting' => $item['config'],
'main_option_for_display' => $item['measurement'],
'configurations' => []
];
}
@@ -106,7 +109,7 @@ foreach ($products as $product) {
}
}
}
// Add all version configurations to the catalog
$catalog[$product['rowID']]['versions'] = array_values($version_configurations);
}

2
api/v2/get/history.php
View File

@@ -68,7 +68,7 @@ if(isset($get_content) && $get_content!=''){
//Filter out only relevant servicereports
$filter_key_1 = '"%serialnumber%"';
$filter_key_2 = '"ServiceReport"';
$clause .= ' AND h.type = '.$filter_key_2.' AND h.description like '.$filter_key_1;
$clause .= ' AND h.type = '.$filter_key_2.' AND NOT e.productrowid = "31" AND h.description like '.$filter_key_1;
}
elseif ($v[0] == 'created') {
//build up search

2
api/v2/get/products_configurations.php
View File

@@ -69,7 +69,7 @@ if (isset($criterias['productrowid']) && $criterias['productrowid'] != ''){
}
else {
//SQL for Paging include name from different tables
$sql = 'SELECT pc.*, pv.config,pag.group_mandatory, pag.group_type,
$sql = 'SELECT pc.*, pv.config,pv.measurement,pag.group_mandatory, pag.group_type,
CASE WHEN p.rowID IS NOT NULL THEN p.productname
WHEN pag.group_id IS NOT NULL THEN pag.group_name
END AS assignment_name,

50
api/v2/post/dealers.php
View File

@@ -3,16 +3,17 @@ defined($security_key) or exit;
ini_set('display_errors', '1');
ini_set('display_startup_errors', '1');
error_reporting(E_ALL);
//------------------------------------------
// dealers
//------------------------------------------
//Connect to DB
$pdo = dbConnect($dbname);
//CONTENT FROM API (POST)
$post_content = json_decode($input,true);
//CHECK IF REQUEST IS FROM DEALERFINDER
if(isset($post_content['bounds'])){
//++++++++++++++++++++++
@@ -194,6 +195,8 @@ elseif(isset($post_content['dealerfinder'])){
}
//CHECK ALL THE POSTED ITEMS
//CHECK ALL THE POSTED ITEMS
$orderByParts = [];
foreach ($post_content as $key => $value){
//GET FILTER CRITERIA
if ($key !='submit' && $key !='city' && $key !='range' && $key !='lat' && $key !='lng' && $value !='C'){
@@ -204,80 +207,75 @@ elseif(isset($post_content['dealerfinder'])){
//check value returned and include SQL
switch ($value) {
case '1':
$sql .= 'case when d.'.$key.' = 1 then 1 else 0 end +';
$orderByParts[] = 'case when d.'.$key.' = 1 then 1 else 0 end';
break;
case '0':
$sql .= 'case when d.'.$key.' = 0 then 1 else 0 end +';
$orderByParts[] = 'case when d.'.$key.' = 0 then 1 else 0 end';
break;
}
//------------------------------------
break;
case ($field_question_2 ?? 'showroom_quality'): //showroom_quality
//check value returned and include SQL
switch ($value) {
case '2':
$sql .= 'case when d.'.$key.' = 2 then 1 else 0 end +';
$orderByParts[] = 'case when d.'.$key.' = 2 then 1 else 0 end';
break;
case '1':
$sql .= 'case when d.'.$key.' = 1 then 1 else 0 end +';
$orderByParts[] = 'case when d.'.$key.' = 1 then 1 else 0 end';
break;
case '0':
$sql .= 'case when d.'.$key.' = 0 then 1 else 0 end +';
$orderByParts[] = 'case when d.'.$key.' = 0 then 1 else 0 end';
break;
}
//------------------------------------
break;
case ($field_question_3 ?? 'showroom_size'): //showroom_size
//check value returned and include SQL
switch ($value) {
case '2':
$sql .= 'case when d.'.$key.' = 2 then 1 else 0 end +';
$orderByParts[] = 'case when d.'.$key.' = 2 then 1 else 0 end';
break;
case '1':
$sql .= 'case when d.'.$key.' = 1 then 1 else 0 end +';
$orderByParts[] = 'case when d.'.$key.' = 1 then 1 else 0 end';
break;
case '0':
$sql .= 'case when d.'.$key.' = 0 then 1 else 0 end +';
$orderByParts[] = 'case when d.'.$key.' = 0 then 1 else 0 end';
break;
}
//------------------------------------
break;
case ($field_question_4 ?? 'brand_category'): //brand_category
//check value returned and include SQL
switch ($value) {
case '2':
$sql .= 'case when d.'.$key.' = 2 then 1 else 0 end +';
$orderByParts[] = 'case when d.'.$key.' = 2 then 1 else 0 end';
break;
case '1':
$sql .= 'case when d.'.$key.' = 1 then 1 else 0 end +';
$orderByParts[] = 'case when d.'.$key.' = 1 then 1 else 0 end';
break;
case '0':
$sql .= 'case when d.'.$key.' = 0 then 1 else 0 end +';
$orderByParts[] = 'case when d.'.$key.' = 0 then 1 else 0 end';
break;
}
//------------------------------------
break;
}
}
}
//Replace LAST J
$sql = removeTrailingElement($sql, ',');
//REPLACE LAST + with DESC
$sql = removeTrailingElement($sql, '+').' desc limit 0,4';
// Build the final ORDER BY clause
if (!empty($orderByParts)) {
// If we have filter criteria, order by the sum of matching criteria descending
$sql .= '(' . implode(' + ', $orderByParts) . ') desc limit 0,4';
} else {
// If no criteria (all "C" values), just order by name or some default
$sql .= 'd.name asc limit 0,4';
}
//Prepare statement
$stmt = $pdo->prepare($sql);

16
assets/functions.php
View File

@@ -842,6 +842,7 @@ function getWhereclause($table_name,$permission,$partner,$method){
switch ($permission) {
case '4':
$whereclause = '';
$condition = '';
break;
case '3':
$condition = '__salesid___'.$partner->salesid.'___soldto___%';
@@ -892,6 +893,7 @@ function getWhereclauselvl2($table_name,$permission,$partner,$method){
switch ($permission) {
case '4':
$whereclause = '';
$condition = '';
break;
case '3':
$condition = '__salesid___'.$partner->salesid.'___soldto___%';
@@ -3330,6 +3332,7 @@ function processProductCollection($products) {
// Add version specific data
$versionProduct['version_id'] = $version['version_id'];
$versionProduct['config_setting'] = $version['config_setting'];
$versionProduct['main_option_for_display'] = $version['main_option_for_display'];
$versionProduct['configurations'] = $version['configurations'];
// Only modify identifiers if there's more than one version
@@ -3630,7 +3633,14 @@ class ShoppingCartCalculator {
$stmt->execute([$this->selected_country]);
$tax = $stmt->fetch(PDO::FETCH_ASSOC);
return $tax ? ($amount_to_tax * ($tax['rate'] / 100)) : 0;
if ($this->business_type === 'b2c') {
// Tax is included in final price
return $tax ? ($amount_to_tax - ($amount_to_tax / ( 1 + ($tax['rate'] / 100)))) : 0;
} else {
// Tax is added on top for B2B
return $tax ? ($amount_to_tax * ($tax['rate'] / 100)) : 0;
}
}
private function calculateFinalTotal($subtotal, $shippingtotal, $discounttotal, $taxtotal) {
@@ -4025,7 +4035,7 @@ function getDomainName($hostname) {
// encode ID to UUID
//=======================================
function encodeUuid($number) {
$alphabet = '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ!@#$%&?-';
$alphabet = '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ';
$base = strlen($alphabet);
$encoded = '';
@@ -4049,7 +4059,7 @@ function encodeUuid($number) {
function decodeUuid($encoded) {
$encoded = strtoupper($encoded);
$alphabet = '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ!@#$%&?-';
$alphabet = '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ';
$base = strlen($alphabet);
$number = 0;

1280
assets/qrcode/qrcode.php Normal file
View File

File diff suppressed because it is too large Load Diff

4
equipment.php
View File

@@ -47,11 +47,11 @@ if (!empty($media_responses)){$media_responses = json_decode($media_responses,tr
$media_responses = $media_responses[0];
//CALL TO API FOR History
$api_url = '/v1/equipments/equipmentID='.$responses->equipmentID.'&type=ServiceReport&history=1';
$api_url = '/v2/equipments/equipmentID='.$responses->equipmentID.'&type=ServiceReport&history=1';
$history = ioServer($api_url,'');
//Decode Payload
if (!empty($history)){$history = decode_payload($history);}else{$history = null;}
if (!empty($history)){$history = json_decode($history);}else{$history = null;}
//CALL TO API FOR EQUIPMENT DATA
$api_url = '/v1/equipment_data/equipmentid='.$responses->equipmentID;

8
products_versions.php
View File

@@ -135,9 +135,15 @@ $view .= '<div class="content-block tab-content active">
</table>
</div>';
if (!is_array(json_decode($products_versions['measurement'],true))){
$view .= '
<label for="">'.($product_version_main_product_option ?? 'Main Product Option').'</label>
<input type="text" name="measurement" placeholder="'.($product_version_main_product_option ?? 'Main Product Option').'" value="'.$products_versions['measurement'].'">';
}
}
if (isset($_GET['rowID']) && $_GET['rowID'] !='' && !empty($products_versions['measurement'])){
if (isset($_GET['rowID']) && $_GET['rowID'] !='' && !empty($products_versions['measurement']) && is_array(json_decode($products_versions['measurement'],true))){
$measurements = json_decode($products_versions['measurement'],true);
$view .= '

1
settings/systemservicetool.php
View File

@@ -63,7 +63,6 @@ $arrayQuestions_visual = array(
array("Question_sequence" => '2',"QuestionID" => "service_visual_14", "Question" => $service_visual_14, "Type" => 'Radiobutton', "Response" => $allowedResponseDropdownCorrosion),
array("Question_sequence" => '2',"QuestionID" => "service_visual_15", "Question" => $service_visual_15, "Type" => 'Radiobutton', "Response" => $allowedResponseRadio),
array("Question_sequence" => '2',"QuestionID" => "service_visual_16", "Question" => $service_visual_16, "Type" => 'Radiobutton', "Response" => $allowedResponseRadio),
array("Question_sequence" => '2',"QuestionID" => "service_visual_17", "Question" => $service_visual_17, "Type" => 'Radiobutton', "Response" => $allowedResponseDropdownCorrosion),
array("Question_sequence" => '2',"QuestionID" => "service_visual_18", "Question" => $service_visual_18, "Type" => 'Radiobutton', "Response" => $allowedResponseRadio)
)
),

38
settings/systemservicetool_init.php
View File

@@ -53,17 +53,17 @@ $init = array(
"AnalogVoltagePP_EP_0_Max"=> 4.8,
"AnalogVoltagePP_EP_0_Min"=> 4.1,
"AnalogVoltagePP_EP_680_Max"=> 3.4,
"AnalogVoltagePP_EP_680_Min"=> 2.9,
"AnalogVoltagePP_EP_680_Min"=> 2.85,
"AnalogVoltagePP_EP_480_Max"=> 2.9,
"AnalogVoltagePP_EP_480_Min"=> 2.5,
"AnalogVoltagePP_EP_330_Max"=> 2.5,
"AnalogVoltagePP_EP_330_Min"=> 2.1,
"AnalogVoltageCP_0_POS_Max"=> 12.5,
"AnalogVoltageCP_0_POS_Min"=> 11.5,
"AnalogVoltageCP_0_NEG_Max"=> -11.5,
"AnalogVoltageCP_0_NEG_Min"=> -12.5,
"AnalogVoltageCP_2K74_POS_Max"=> 9.2,
"AnalogVoltageCP_2K74_POS_Min"=> 8.7,
"AnalogVoltagePP_EP_480_Min"=> 2.55,
"AnalogVoltagePP_EP_330_Max"=> 2.55,
"AnalogVoltagePP_EP_330_Min"=> 2.15,
"AnalogVoltageCP_0_POS_Max"=> 12.6,
"AnalogVoltageCP_0_POS_Min"=> 11.4,
"AnalogVoltageCP_0_NEG_Max"=> -11.4,
"AnalogVoltageCP_0_NEG_Min"=> -12.6,
"AnalogVoltageCP_2K74_POS_Max"=> 9.59,
"AnalogVoltageCP_2K74_POS_Min"=> 8.37,
"AnalogVoltagePP_EP_Off_Max"=>0.3,
"AnalogVoltagePP_EP_Off_Min"=>-0.5
),
@@ -73,17 +73,17 @@ $init = array(
"AnalogVoltagePP_EP_0_Max"=> 4.8,
"AnalogVoltagePP_EP_0_Min"=> 4.1,
"AnalogVoltagePP_EP_680_Max"=> 3.4,
"AnalogVoltagePP_EP_680_Min"=> 2.9,
"AnalogVoltagePP_EP_680_Min"=> 2.85,
"AnalogVoltagePP_EP_480_Max"=> 2.9,
"AnalogVoltagePP_EP_480_Min"=> 2.5,
"AnalogVoltagePP_EP_330_Max"=> 2.5,
"AnalogVoltagePP_EP_480_Min"=> 2.55,
"AnalogVoltagePP_EP_330_Max"=> 2.55,
"AnalogVoltagePP_EP_330_Min"=> 2.1,
"AnalogVoltageCP_0_POS_Max"=> 12.5,
"AnalogVoltageCP_0_POS_Min"=> 11.5,
"AnalogVoltageCP_0_NEG_Max"=> -11.5,
"AnalogVoltageCP_0_NEG_Min"=> -12.5,
"AnalogVoltageCP_2K74_POS_Max"=> 9.2,
"AnalogVoltageCP_2K74_POS_Min"=> 8.7,
"AnalogVoltageCP_0_POS_Max"=> 12.6,
"AnalogVoltageCP_0_POS_Min"=> 11.4,
"AnalogVoltageCP_0_NEG_Max"=> -11.4,
"AnalogVoltageCP_0_NEG_Min"=> -12.6,
"AnalogVoltageCP_2K74_POS_Max"=> 9.59,
"AnalogVoltageCP_2K74_POS_Min"=> 8.37,
"AnalogVoltagePP_EP_Off_Max"=>0.3,
"AnalogVoltagePP_EP_Off_Min"=>-0.5
),

2
translation_manage.php
View File

@@ -244,6 +244,7 @@ $view .= '
<tr>
<td>
<select form="update" id="language" name="item['.$translation['rowID'].'][language_key]">';
$view .= '<option value="FR">FR</option>';
foreach ($supportedLanguages as $language){
$view .='<option value="'.$language.'" '.(($translation['language_key'] == $language)?' selected':'').'>'.$language.'</option>';
}
@@ -271,6 +272,7 @@ $view .= '
newRow.innerHTML = `
<td><select form="new" id="language" name="language_key">';
$view .= '<option value="FR">FR</option>';
foreach ($supportedLanguages as $language){
$view .= '<option value="'.$language.'">'.$language.'</option>';
}