Bug in backups.php, 'protect', fixed.
[fa-stable.git] / admin / backups.php
index e653757977360e8a2af23eaf32c78617f572773f..01ef0732acc41e8be64c2903e651c0a87a4eeec9 100644 (file)
 <?php
-
-$page_security = 15;
+/**********************************************************************
+    Copyright (C) FrontAccounting, LLC.
+       Released under the terms of the GNU General Public License, GPL, 
+       as published by the Free Software Foundation, either version 3 
+       of the License, or (at your option) any later version.
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  
+    See the License here <http://www.gnu.org/licenses/gpl-3.0.html>.
+***********************************************************************/
+$page_security = 'SA_BACKUP';
 
 $path_to_root="..";
 include_once($path_to_root . "/includes/session.inc");
 include_once($path_to_root . "/includes/ui.inc");
 include_once($path_to_root . "/admin/db/maintenance_db.inc");
 
-$valid_paths = valid_paths();
-//$valid_paths = '';
-if ($valid_paths != "")
-{
-       page(_("Backup and Restore Database - Error"));
-       display_error (_("Backup paths have not been set correctly.") ."&nbsp;&nbsp;&nbsp;" . _("Please contact System Administrator.") . "<br>" .$valid_paths);
-       end_page();
-       exit;
-}
-
-$db_name = $_SESSION["wa_current_user"]->company;
-$msg = handle_form($db_connections[$db_name]);
-
-page(_("Backup and Restore Database"), false, false, '', '', true);
-
-//-------------------------------------------------------------------------------
-start_form(true, true);
-
-$cmb = get_backup_file_combo();
-$compr = get_compr_combo();
-
-echo "
-       <script language='javascript'>
-       function createBackup() {
-               ext = document.forms[0].cmb_comp.options[document.forms[0].cmb_comp.selectedIndex].value
-               comm = document.forms[0].comments.value
-               document.location.replace('backups.php?c=g&comp='+ext+'&comm='+comm)
-       }
-       function restoreBackup() {
-               pFilename = document.forms[0].cmb_backups.options[document.forms[0].cmb_backups.selectedIndex].value
-               document.location.replace('backups.php?c=r&fn='+pFilename)
-       }
-       function viewBackup() {
-               pFilename = document.forms[0].cmb_backups.options[document.forms[0].cmb_backups.selectedIndex].value
-               var ext = pFilename.substr(pFilename.lastIndexOf('.') + 1)
-               if (ext != 'sql') {
-                       alert('" . _('This extension can not be be viewed: ') . "' + ext)
-                       return
-               }
-               window.open('" . BACKUP_PATH . "'+pFilename, '', 'toolbar=no,scrollbars=yes')
-       }
-       function deleteBackup() {
-               pFilename = document.forms[0].cmb_backups.options[document.forms[0].cmb_backups.selectedIndex].value
-               if (!confirm('" . _("Are you sure you want to delete the backup file - ") . "'+pFilename+'?'))
-                       return
-               document.location.replace('backups.php?c=df&fn='+pFilename)
-       }
-       function downloadBackup() {
-               pFilename = document.forms[0].cmb_backups.options[document.forms[0].cmb_backups.selectedIndex].value
-               document.location.replace('backups.php?c=ds&fn='+pFilename)
-               Behaviour.apply();
-       }
-       function uploadBackup() {
-               if (document.forms[0].uploadfile.value=='') {
-                       alert('" . _("Please select a file to upload.") . "')
-                       return
+if (get_post('view')) {
+       if (!get_post('backups')) {
+               display_error(_('Select backup file first.'));
+       } else {
+               $filename = $SysPrefs->backup_dir() . clean_file_name(get_post('backups'));
+               if (in_ajax()) 
+                       $Ajax->popup( $filename );
+               else {
+                       header('Content-type: text/plain');
+                       header('Content-Length: '.filesize($filename));
+                       header("Content-Disposition: inline; filename=".basename($filename));
+                       if (substr($filename, -3, 3) == '.gz')
+                               header("Content-Encoding: gzip");
+
+                       if (substr($filename, -4, 4) == '.zip')
+                               echo db_unzip('', $filename);
+                       else
+                               readfile($filename);
+                       exit();
                }
-               document.forms[0].action='backups.php?c=u&fn=' + document.forms[0].uploadfile.value
-               document.forms[0].submit()
        }
-       </script>
-       <center>
-       <table cellpadding=2 cellspacing=2 border=0>
-       <tr><td colspan=2 style='color:darkred'><b>$msg</b>&nbsp;</td></tr>
-       <tr>
-               <td style='padding-right:30px'>" . _("Backup scripts") . "</td>
-       </tr>
-       <tr>
-               <td style='padding-right:30px'>$cmb</td>
-               <script language='javascript'>
-                       if (document.forms[0].cmb_backups.options.length!=0) document.forms[0].cmb_backups.selectedIndex=0
-               </script>
-               <td>
-                       <table height=160 cellpadding=0 cellspacing=0 border=0>
-                       <tr><td><input onclick='javascript:createBackup()' type='button' style='width:150px' value='". _("Create Backup") . "'></td><td style='padding-left:20px'>" . _("Compression") . "&nbsp;&nbsp;$compr</td></tr>
-                       <tr><td><input onclick='javascript:restoreBackup()' type='button' style='width:150px' value='". _("Restore Backup") . "'></td><td>&nbsp;</td></tr>
-                       <tr><td><input onclick='javascript:viewBackup()' type='button' style='width:150px' value='". _("View Backup") . "'></td><td>&nbsp;</td></tr>
-                       <tr><td><input onclick='javascript:deleteBackup()' type='button' style='width:150px' value='". _("Delete Backup") . "'></td><td>&nbsp;</td></tr>
-                       <tr><td><input onclick='javascript:downloadBackup()' type='button' style='width:150px' value='". _("Download Backup") . "'></td><td>&nbsp;</td></tr>
-                       <tr><td><input onclick='javascript:uploadBackup()' type='button' style='width:150px' value='". _("Upload Backup"). "'></td>
-                               <td style='padding-left:20px'><input name='uploadfile' type='file'></td>
-                       </tr>
-                       </table>
-               </td>
-       </tr>
-       <tr>
-               <td style='padding-right:30px'>" . _("Comments") . " (" . _("Create Backup") . ")</td>
-       </tr>
-       <tr>
-               <td style='padding-right:30px'><textarea rows=4 cols=30 name='comments'></textarea></td>
-       </tr>
-       </table></center>";
-
-end_form();
-
-//-------------------------------------------------------------------------------------------------
+};
+
+if (get_post('download')) {
+       if (get_post('backups')) {
+               download_file($SysPrefs->backup_dir().clean_file_name(get_post('backups')));
+               exit;
+       } else
+               display_error(_("Select backup file first."));
+}
 
-end_page();
+page(_($help_context = "Backup and Restore Database"), false, false, '', '');
 
+check_paths();
 
-function handle_form($conn)
+function check_paths()
 {
-       global $path_to_root;
-       //Generate Only
-       if (isset($_GET['c']))
-       {
-               if ($_GET['c']=='g')
-               {
-                       $filename = generate_backup($conn, $_GET['comp'], $_GET['comm']);
-                       header("Location: backups.php?c=gs&fn=" . urlencode($filename));
-                       return "";
-               }
-               //Generate and download
-               if ($_GET['c']=='gd')
-               {
-                       $filename = generate_backup($conn);
-                       header("Location: backups.php?c=ds&fn=" . urlencode($filename));
-                       return "";
-               }
-               //Download the file
-               if ($_GET['c']=='d')
-               {
-                       download_file(BACKUP_PATH . $_GET['fn']);
-                       exit;
-               }
-               //Delete the file
-               if ($_GET['c']=='df')
-               {
-                       $filename = $_GET['fn'];
-                       @unlink(BACKUP_PATH . $filename);
-                       header("Location: backups.php?c=dff&fn=" . urlencode($filename));
-                       return "";
-               }
-               if ($_GET['c']=='dff')
-               {
-                       $msg = _("File successfully deleted.")."&nbsp;&nbsp;&nbsp;";
-                       $msg .= _("Filename") . " = " . $_GET['fn'];
-                       return $msg;
-               }
-               //Write JS script to open download window
-               if ($_GET['c']=='ds')
-               {
-                       $filename = urlencode($_GET['fn']);
-                       $msg = _("Backup is being downloaded...");
-                       $msg .= "<script language='javascript'>";
-                       $msg .= "function download_file() {location.href ='backups.php?c=d&fn=$filename'}; 
-                               Behaviour.addLoadEvent(download_file);";
-                       $msg .= "</script>";
-                       return $msg;
-               }
-               //Print backup success message
-               if ($_GET['c']=='gs')
-               {
-                       $msg = _("Backup successfully generated.")."&nbsp;&nbsp;&nbsp;";
-                       $msg .= _("Filename") . " = " . $_GET['fn'];
-                       return $msg;
-               }
-               //Restore backup
-               if ($_GET['c']=='r')
-               {
-                       $filename=$_GET['fn'];
-                       if( restore_backup(BACKUP_PATH . $filename, $conn) )
-                               header("Location: backups.php?c=rs&fn=" . urlencode($filename));
-                       return "";
-               }
-               //Print restore success message
-               if ($_GET['c']=='rs')
-               {
-                       $msg = _("Restore backup completed.")."&nbsp;&nbsp;&nbsp;";
-                       return $msg;
-               }
-
-               if ($_GET['c']=='u')
-               {
-                       $filename = $_FILES['uploadfile']['tmp_name'];
-                       if (is_uploaded_file ($filename))
-                       {
-                               if( restore_backup($filename, $conn) )
-                                       $msg = _("Uploaded file has been restored.");
-                               else
-                                       $msg = _("Database restore failed.");   
-                       }
-                       else
-                       {
-                               $msg = _("Backup was not uploaded into the system.");
-                       }
-                       return $msg;
-               }
+  global $SysPrefs;
+
+       if (!file_exists($SysPrefs->backup_dir())) {
+               display_error (_("Backup paths have not been set correctly.") 
+                       ._("Please contact System Administrator.")."<br>" 
+                       . _("cannot find backup directory") . " - " . $SysPrefs->backup_dir() . "<br>");
+               end_page();
+               exit;
        }
-       return "";
 }
 
 function generate_backup($conn, $ext='no', $comm='')
 {
-       if ($conn['tbpref'] != "")
-               $filename = $conn['dbname'] . "_" . $conn['tbpref'] . date("Ymd_Hi") . ".sql";
-       else
-               $filename = $conn['dbname'] . "_" . date("Ymd_Hi") . ".sql";
+       global $SysPrefs;
 
-       $filename = db_export($conn, $filename, $ext, $comm);
+       $filename = db_backup($conn, $ext, $comm, $SysPrefs->backup_dir());
+       if ($filename)
+               display_notification(_("Backup successfully generated."). ' '
+                       . _("Filename") . ": " . $filename);
+       else
+               display_error(_("Database backup failed."));
 
        return $filename;
 }
 
-function restore_backup($filename, $conn)
-{
-       return db_import($filename, $conn);
-}
 
 function get_backup_file_combo()
 {
-       global $path_to_root;
+       global $path_to_root, $Ajax, $SysPrefs;
+       
        $ar_files = array();
-    default_focus('cmb_backups');
-    $dh = opendir(BACKUP_PATH);
+    default_focus('backups');
+    $dh = opendir($SysPrefs->backup_dir());
        while (($file = readdir($dh)) !== false)
                $ar_files[] = $file;
        closedir($dh);
@@ -229,50 +93,137 @@ function get_backup_file_combo()
     rsort($ar_files);
        $opt_files = "";
     foreach ($ar_files as $file)
-       if (strpos($file, ".sql") || strpos($file, ".sql"))
+               if (preg_match("/.sql(.zip|.gz)?$/", $file))
                $opt_files .= "<option value='$file'>$file</option>";
 
-       return "<select name='cmb_backups' size=2 style='height:160px;width:230px'>$opt_files</select>";
+       $selector = "<select name='backups' size=2 style='height:160px;min-width:230px'>$opt_files</select>";
+
+       $Ajax->addUpdate('backups', "_backups_sel", $selector);
+       $selector = "<span id='_backups_sel'>".$selector."</span>\n";
+
+       return $selector;
 }
 
-function get_compr_combo()
+function compress_list_row($label, $name, $value=null)
 {
-       $ar_comps = array();
+       $ar_comps = array('no'=>_("No"));
 
-       $ar_comps[] = _("No");
     if (function_exists("gzcompress"))
-       $ar_comps[] = "zip";
+       $ar_comps['zip'] = "zip";
     if (function_exists("gzopen"))
-       $ar_comps[] = "gzip";
-       $opt_comps = "";
-    foreach ($ar_comps as $file)
-       $opt_comps .= "<option value='$file'>$file</option>";
+       $ar_comps['gzip'] = "gzip";
 
-       return "<select name='cmb_comp'>$opt_comps</select>";
+       echo "<tr><td class='label'>$label</td><td>";
+       echo array_selector('comp', $value, $ar_comps);
+       echo "</td></tr>";
 }
 
 function download_file($filename)
 {
     if (empty($filename) || !file_exists($filename))
     {
-        return FALSE;
+               display_error(_('Select backup file first.'));
+        return false;
     }
     $saveasname = basename($filename);
     header('Content-type: application/octet-stream');
-    header('Content-Length: '.filesize($filename));
-    header('Content-Disposition: attachment; filename="'.$saveasname.'"');
+       header('Content-Length: '.filesize($filename));
+       header('Content-Disposition: attachment; filename="'.$saveasname.'"');
     readfile($filename);
+
     return true;
 }
 
-function valid_paths()
+$conn = $db_connections[user_company()];
+$backup_name = clean_file_name(get_post('backups'));
+$backup_path = $SysPrefs->backup_dir() . $backup_name;
+
+if (get_post('creat')) {
+       generate_backup($conn, get_post('comp'), get_post('comments'));
+       $Ajax->activate('backups');
+       $SysPrefs->refresh(); // re-read system setup
+};
+
+if (get_post('restore')) {
+       if ($backup_name) {
+               if (db_import($backup_path, $conn, true, false, check_value('protect')))
+                       display_notification(_("Restore backup completed."));
+               $SysPrefs->refresh(); // re-read system setup
+       } else
+               display_error(_("Select backup file first."));
+}
+
+if (get_post('deldump')) {
+       if ($backup_name) {
+               if (unlink($backup_path)) {
+                       display_notification(_("File successfully deleted.")." "
+                                       . _("Filename") . ": " . $backup_name);
+                       $Ajax->activate('backups');
+               }
+               else
+                       display_error(_("Can't delete backup file."));
+       } else
+               display_error(_("Select backup file first."));
+}
+
+if (get_post('upload'))
 {
-       global $path_to_root;
+       $tmpname = $_FILES['uploadfile']['tmp_name'];
+       $fname = trim(basename($_FILES['uploadfile']['name']));
+
+       if ($fname) {
+               if (!preg_match("/\.sql(\.zip|\.gz)?$/", $fname))
+                       display_error(_("You can only upload *.sql backup files"));
+               elseif ($fname != clean_file_name($fname))
+                       display_error(_("Filename contains forbidden chars. Please rename file and try again."));
+               elseif (is_uploaded_file($tmpname)) {
+                       rename($tmpname, $SysPrefs->backup_dir() . $fname);
+                       display_notification(_("File uploaded to backup directory"));
+                       $Ajax->activate('backups');
+               } else
+                       display_error(_("File was not uploaded into the system."));
+       } else
+               display_error(_("Select backup file first."));
 
-       $st = "";
-       if (!file_exists(BACKUP_PATH))
-               $st .= "&nbsp;&nbsp;&nbsp;-&nbsp;" . _("cannot find backup directory") . " - " . BACKUP_PATH . "<br>";
-       return $st;
 }
+//-------------------------------------------------------------------------------
+start_form(true, true);
+start_outer_table(TABLESTYLE2);
+table_section(1);
+table_section_title(_("Create backup"));
+       textarea_row(_("Comments:"), 'comments', null, 30, 8);
+       compress_list_row(_("Compression:"),'comp');
+       vertical_space("height='20px'");
+       submit_row('creat',_("Create Backup"), false, "colspan=2 align='center'", '', 'process');
+table_section(2);
+table_section_title(_("Backup scripts maintenance"));
+
+       start_row();
+       echo "<td style='padding-left:20px' align='left'>".get_backup_file_combo()."</td>";
+       echo "<td style='padding-left:20px' valign='top'>";
+       start_table();
+       submit_row('view',_("View Backup"), false, '', '', false);
+       submit_row('download',_("Download Backup"), false, '', '', 'download');
+       submit_row('restore',_("Restore Backup"), false, '','', 'process');
+       submit_js_confirm('restore',_("You are about to restore database from backup file.\nDo you want to continue?"));
+
+       submit_row('deldump', _("Delete Backup"), false, '','', true);
+       // don't use 'delete' name or IE js errors appear
+       submit_js_confirm('deldump', sprintf(_("You are about to remove selected backup file.\nDo you want to continue ?")));
+       end_table();
+       echo "</td>";
+       end_row();
+start_row();
+       echo "<td style='padding-left:20px'  cspan=2>"
+       . radio(_('Update security settings'), 'protect', 0) . '<br>'
+       . radio(_('Protect security settings'), 'protect', 1, true) . "</td>";
+end_row();
+start_row();
+       echo "<td style='padding-left:20px' align='left'><input name='uploadfile' type='file'></td>";
+       submit_cells('upload',_("Upload file"),"style='padding-left:20px'", '', true);
+end_row();
+end_outer_table();
 
-?>
\ No newline at end of file
+end_form();
+
+end_page();