X-Git-Url: https://delta.frontaccounting.com/gitweb/?a=blobdiff_plain;f=sql%2Falter2.2.php;h=c5345233f9dad968a351735b71f50b2df0a31924;hb=510d6e1925c4d1621ae3efd85e117cc9bb4320f0;hp=091e8860f9284c8631ce1107e66cb80f3db94524;hpb=6bdb8986a143a35e8f8a1c318bd14fab839000b2;p=fa-stable.git
diff --git a/sql/alter2.2.php b/sql/alter2.2.php
index 091e8860..c5345233 100644
--- a/sql/alter2.2.php
+++ b/sql/alter2.2.php
@@ -12,11 +12,15 @@
class fa2_2 {
var $version = '2.2'; // version installed
- var $description = 'Version 2.2';
+ var $description;
var $sql = 'alter2.2.sql';
var $preconf = true;
+ var $beta = false; // upgrade from 2.1 or 2.2beta; set in pre_check
function fa2_2() {
+ global $security_groups;
+ $this->beta = !isset($security_groups);
+ $this->description = _('Upgrade from version 2.1/2.2beta to 2.2');
$this->preconf = fix_extensions();
}
@@ -30,7 +34,15 @@ class fa2_2 {
if (!$this->preconf)
return false;
-
+
+ // Until 2.2 sanitizing text input with db_escape was not
+ // consequent enough. To avoid comparision problems we have to
+ // fix this now.
+ sanitize_database($pref);
+
+ if ($this->beta) // nothing more to be done on upgrade from 2.2beta
+ return true;
+
// set item category dflt accounts to values from company GL setup
$prefs = get_company_prefs();
$sql = "UPDATE {$pref}stock_category SET "
@@ -49,14 +61,14 @@ class fa2_2 {
$info = get_systype_db_info($typeno);
if ($info == null || $info[3] == null) continue;
$tbl = str_replace(TB_PREF, $pref, $info[0]);
- $sql = "SELECT {$info[2]} as id,{$info[3]} as ref FROM $tbl";
+ $sql = "SELECT DISTINCT {$info[2]} as id,{$info[3]} as ref FROM $tbl";
if ($info[1])
$sql .= " WHERE {$info[1]}=$typeno";
$result = db_query($sql);
if (db_num_rows($result)) {
while ($row = db_fetch($result)) {
$res2 = db_query("INSERT INTO {$pref}refs VALUES("
- . $row['id'].",".$typeno.",'".addslashes($row['ref'])."')");
+ . $row['id'].",".$typeno.",'".$row['ref']."')");
if (!$res2) {
display_error(_("Cannot copy references from $tbl")
.':
'. db_error_msg($db));
@@ -65,84 +77,67 @@ class fa2_2 {
}
}
}
-/* FIX // restore/init audit_trail data
- $datatbl = array (
- "gl_trans"=> array("type", "type_no","tran_date"),
- "purch_orders" => array("order_no", "'18'", "ord_date"),
- "sales_orders" => array("order_no", "'30'", "ord_date"),
- "workorders" => array("id", "'26'", "date_") );
- foreach ( $datatbl as $tblname => $tbl) {
- $sql = "SELECT {$tbl[0]} as type, {$tbl[1]} as trans, {$tbl[2]} as dat"
- . " FROM {$pref}{$tblname}";
- $result = db_query($sql);
- if (db_num_rows($result)) {
- $user = ;
- $year = ;
- while ($row = db_fetch($result)) {
- $sql2 = "INSERT INTO ".$pref."audit_trail"
- ." (type, trans_no, user, fiscal_year, gl_date, gl_seq) VALUES ("
- . "{$row['type']},{$row['trans']},$user,$year,{$row['dat']},0)";
- $res2 = db_query($sql2);
- if (!$res2) {
- display_error(_("Cannot init audit_trail data")
- .':
'. db_error_msg($db));
- return false;
- }
- }
- }
- }
-*/
-
- if (!($ret = db_query("SELECT MAX(`order_no`) FROM `{$pref}sales_orders`")) ||
- !db_num_rows($ret))
- {
- display_error(_('Cannot query max sales order number.'));
- return false;
- }
- $row = db_fetch($ret);
- $max_order = $row[0];
- $next_ref = $max_order+1;
- $sql = "UPDATE `{$pref}sys_types`
- SET `type_no`='$max_order',
- `next_reference`='$next_ref'
- WHERE `type_id`=30";
- if(!db_query($sql))
- {
- display_error(_('Cannot store next sales order reference.'));
- return false;
- }
- return convert_roles($pref);
+ if (!($ret = db_query("SELECT MAX(`order_no`) FROM `{$pref}sales_orders`")) ||
+ !db_num_rows($ret))
+ {
+ display_error(_('Cannot query max sales order number.'));
+ return false;
+ }
+ $row = db_fetch($ret);
+ $max_order = $row[0];
+ $next_ref = $max_order+1;
+ $sql = "UPDATE `{$pref}sys_types`
+ SET `type_no`='$max_order',`next_reference`='$next_ref'
+ WHERE `type_id`=30";
+ if(!db_query($sql))
+ {
+ display_error(_('Cannot store next sales order reference.'));
+ return false;
+ }
+ return convert_roles($pref);
}
//
// Checking before install
//
- function pre_check($pref)
- {
+ function pre_check($pref, $force)
+ {
global $security_groups;
- return isset($security_groups); // true when ok, fail otherwise
+
+ if ($this->beta && !$force)
+ $this->sql = 'alter2.2rc.sql';
+ // return ok when security groups still defined (upgrade from 2.1)
+ // or usersonline not defined (upgrade from 2.2 beta)
+ return isset($security_groups) || (check_table($pref, 'usersonline')!=0);
}
//
// Test if patch was applied before.
//
function installed($pref) {
- $n = 15; // number of features to be installed
- if (check_table($pref, 'company', 'custom1_name')) $n--;
- if (!check_table($pref, 'company', 'profit_loss_year_act')) $n--;
- if (!check_table($pref, 'company', 'login_tout')) $n--;
- if (!check_table($pref, 'stock_category', 'dflt_no_sale')) $n--;
- if (!check_table($pref, 'users', 'sticky_doc_date')) $n--;
- if (!check_table($pref, 'users', 'startup_tab')) $n--;
- if (!check_table($pref, 'cust_branch', 'inactive')) $n--;
- if (!check_table($pref, 'chart_class', 'ctype')) $n--;
- if (!check_table($pref, 'audit_trail')) $n--;
- if (!check_table($pref, 'currencies', 'auto_update')) $n--;
- if (!check_table($pref, 'stock_master','no_sale')) $n--;
- if (!check_table($pref, 'suppliers', 'supp_ref')) $n--;
- if (!check_table($pref, 'users', 'role_id')) $n--;
- if (!check_table($pref, 'sales_orders', 'reference')) $n--;
- if (!check_table($pref, 'tags')) $n--;
- return $n == 0 ? true : 15 - $n;
+ $n = 1; // number of patches to be installed
+ $patchcnt = 0;
+ if (!$this->beta) {
+ $n = 16;
+ if (check_table($pref, 'company', 'custom1_name')) $patchcnt++;
+ if (!check_table($pref, 'company', 'profit_loss_year_act')) $patchcnt++;
+ if (!check_table($pref, 'company', 'login_tout')) $patchcnt++;
+ if (!check_table($pref, 'stock_category', 'dflt_no_sale')) $patchcnt++;
+ if (!check_table($pref, 'users', 'sticky_doc_date')) $patchcnt++;
+ if (!check_table($pref, 'users', 'startup_tab')) $patchcnt++;
+ if (!check_table($pref, 'cust_branch', 'inactive')) $patchcnt++;
+ if (!check_table($pref, 'chart_class', 'ctype')) $patchcnt++;
+ if (!check_table($pref, 'audit_trail')) $patchcnt++;
+ if (!check_table($pref, 'currencies', 'auto_update')) $patchcnt++;
+ if (!check_table($pref, 'stock_master','no_sale')) $patchcnt++;
+ if (!check_table($pref, 'suppliers', 'supp_ref')) $patchcnt++;
+ if (!check_table($pref, 'users', 'role_id')) $patchcnt++;
+ if (!check_table($pref, 'sales_orders', 'reference')) $patchcnt++;
+ if (!check_table($pref, 'tags')) $patchcnt++;
+ }
+ if (!check_table($pref, 'useronline')) $patchcnt++;
+
+ $n -= $patchcnt;
+ return $n == 0 ? true : $patchcnt;
}
};
@@ -167,7 +162,7 @@ function convert_roles($pref)
'SA_SALESBULKREP', 'SA_CUSTSTATREP', 'SA_SUPPLIERANALYTIC',
'SA_SUPPPAYMREP', 'SA_SUPPBULKREP', 'SA_ITEMSVALREP', 'SA_ITEMSANALYTIC',
'SA_BOMREP', 'SA_MANUFBULKREP', 'SA_DIMENSIONREP', 'SA_BANKREP', 'SA_GLREP',
- 'SA_GLANALYTIC', 'SA_TAXREP', 'SA_SALESANALYTIC'),
+ 'SA_GLANALYTIC', 'SA_TAXREP', 'SA_SALESANALYTIC', 'SA_SALESQUOTE'),
3 => array('SA_GLACCOUNTGROUP', 'SA_GLACCOUNTCLASS','SA_PAYMENT',
'SA_DEPOSIT', 'SA_JOURNALENTRY', 'SA_INVENTORYMOVETYPE',
'SA_LOCATIONTRANSFER', 'SA_INVENTORYADJUSTMENT', 'SA_WORKCENTRES',
@@ -248,7 +243,7 @@ function fix_extensions() {
return true; // already converted
if (!is_writable($path_to_root.'/modules/installed_modules.php')) {
- display_error(_('Cannot upgrade extensions system: file /modules/installed_modules.php is no writeable'));
+ display_error(_('Cannot upgrade extensions system: file /modules/installed_modules.php is not writeable'));
return false;
}
@@ -283,6 +278,63 @@ function fix_extensions() {
return true;
}
-$install = new fa2_2;
+/*
+ Find and update all database records with special chars in text fields
+ to ensure all of them are changed to html entites.
+*/
+function sanitize_database($pref, $test = false) {
+
+ if ($test)
+ error_log('Sanitizing database ...');
+
+ $tsql = "SHOW TABLES LIKE '".($pref=='' ? '' : substr($pref,0,-1).'\\_')."%'";
+ $tresult = db_query($tsql, "Cannot select all tables with prefix '$pref'");
+ while($tbl = db_fetch($tresult)) {
+ $table = $tbl[0];
+ $csql = "SHOW COLUMNS FROM $table";
+ $cresult = db_query($csql, "Cannot select column names for table '$table'");
+ $textcols = $keys = array();
+ while($col = db_fetch($cresult)) {
+ if (strpos($col['Type'], 'char')!==false
+ || strpos($col['Type'], 'text')!==false)
+ $textcols[] = '`'.$col['Field'].'`';
+ if ($col['Key'] == 'PRI') {
+ $keys[] = '`'.$col['Field'].'`';
+ }
+ }
+
+ if ($test)
+ error_log("Table $table (".implode(',',$keys)."):(".implode(',',$textcols)."):");
+ if (!count($textcols)) continue;
+
+ // fetch all records containing special characters in text fields
+ $sql = "SELECT ".implode(',', array_unique(array_merge($keys,$textcols)))
+ ." FROM {$table} WHERE
+ CONCAT(".implode(',', $textcols).") REGEXP '[\\'\"><&]'";
+ $result = db_query($sql, "Cannot select all suspicious fields in $table");
+
+ // and fix them
+ while($rec= db_fetch($result)) {
+ $sql = "UPDATE {$table} SET ";
+ $val = $key = array();
+ foreach ($textcols as $f) {
+ $val[] = $f.'='.db_escape($rec[substr($f,1,-1)]);
+ }
+ $sql .= implode(',', $val). ' WHERE ';
+ foreach ($keys as $k) {
+ $key[] = $k.'=\''.$rec[substr($k,1,-1)].'\'';
+ }
+ $sql .= implode( ' AND ', $key);
+ if ($test)
+ error_log("\t(".implode(',',$val).") updated");
+ else
+ db_query($sql, 'cannot update record');
+ }
+ }
+ if ($test)
+ error_log('Sanitizing done.');
+}
+
+$install = new fa2_2;
?>
\ No newline at end of file