issue60, make sure provided photo id is numeric

[phpfspot.git] / phpfspot.class.php

diff --git a/phpfspot.class.php b/phpfspot.class.php
index 6a85ccda447a7bfca76307038e6612be97423ac2..e0a87a567e184ac83174bc222eee0745dc4ddc61 100644 (file)
--- a/phpfspot.class.php
+++ b/phpfspot.class.php
@@ -112,29 +112,29 @@ class PHPFSPOT {
       switch($_GET['mode']) {
          case 'showpi':
             if(isset($_GET['tags'])) {
-               $_SESSION['selected_tags'] = split(',', $_GET['tags']);
+               $_SESSION['selected_tags'] = $this->extractTags($_GET['tags']);
             }
-            if(isset($_GET['from_date'])) {
-               $_SESSION['from_date'] = $_GET['from_date'];
+            if(isset($_GET['from_date']) && $this->isValidDate($_GET['from_date'])) {
+               $_SESSION['from_date'] = strtotime($_GET['from_date']);
             }
-            if(isset($_GET['to_date'])) {
-               $_SESSION['to_date'] = $_GET['to_date'];
+            if(isset($_GET['to_date']) && $this->isValidDate($_GET['to_date'])) {
+               $_SESSION['to_date'] = strtotime($_GET['to_date']);
             }
             break;
          case 'showp':
             if(isset($_GET['tags'])) {
-               $_SESSION['selected_tags'] = split(',', $_GET['tags']);
+               $_SESSION['selected_tags'] = $this->extractTags($_GET['tags']);
                $_SESSION['start_action'] = 'showp';
             }
-            if(isset($_GET['id'])) {
+            if(isset($_GET['id']) && is_numeric($_GET['id'])) {
                $_SESSION['current_photo'] = $_GET['id'];
                $_SESSION['start_action'] = 'showp';
             }
-            if(isset($_GET['from_date'])) {
-               $_SESSION['from_date'] = $_GET['from_date'];
+            if(isset($_GET['from_date']) && $this->isValidDate($_GET['from_date'])) {
+               $_SESSION['from_date'] = strtotime($_GET['from_date']);
             }
-            if(isset($_GET['to_date'])) {
-               $_SESSION['to_date'] = $_GET['to_date'];
+            if(isset($_GET['to_date']) && $this->isValidDate($_GET['to_date'])) {
+               $_SESSION['to_date'] = strtotime($_GET['to_date']);
             }
             break;
          case 'export':
@@ -147,13 +147,15 @@ class PHPFSPOT {
             break;
       }
 
+      if(isset($_SESSION['from_date']) && isset($_SESSION['to_date']))
+         $this->tmpl->assign('date_search_enabled', true);
+
       $this->tmpl->assign('from_date', $this->get_calendar('from'));
       $this->tmpl->assign('to_date', $this->get_calendar('to'));
       $this->tmpl->assign('sort_field', $this->get_sort_field());
       $this->tmpl->assign('content_page', 'welcome.tpl');
       $this->tmpl->show("index.tpl");
 
-
    } // show()
 
    /**
@@ -327,7 +329,7 @@ class PHPFSPOT {
          $extern_link.= "&tags=". $current_tags;
       }
       if(isset($_SESSION['from_date']) && isset($_SESSION['to_date'])) {
-         $extern_link.= "&from_date=". $_SESSION['from_date'] ."&to_date=". $_SESSION['to_date'];
+         $extern_link.= "&from_date=". $this->ts2str($_SESSION['from_date']) ."&to_date=". $this->ts2str($_SESSION['to_date']);
       }
 
       $this->tmpl->assign('extern_link', $extern_link);
@@ -564,8 +566,8 @@ class PHPFSPOT {
       $matched_photos = Array();
 
       if(isset($_SESSION['from_date']) && isset($_SESSION['to_date'])) {
-         $from_date = strtotime($_SESSION['from_date']);
-         $to_date = strtotime($_SESSION['to_date']);
+         $from_date = $_SESSION['from_date'];
+         $to_date = $_SESSION['to_date'];
          $additional_where_cond = "
                p.time>='". $from_date ."'
             AND
@@ -780,8 +782,8 @@ class PHPFSPOT {
          $this->tmpl->assign('searchfor', $_SESSION['searchfor']);
 
       if(isset($_SESSION['from_date']) && isset($_SESSION['to_date'])) {
-         $this->tmpl->assign('from_date', $_SESSION['from_date']);
-         $this->tmpl->assign('to_date', $_SESSION['to_date']);
+         $this->tmpl->assign('from_date', $this->ts2str($_SESSION['from_date']));
+         $this->tmpl->assign('to_date', $this->ts2str($_SESSION['to_date']));
       }
 
       if(isset($_SESSION['selected_tags']) && !empty($_SESSION['selected_tags'])) {
@@ -818,7 +820,7 @@ class PHPFSPOT {
          for($i = 1; $i <= $last_page; $i++) {
 
             if($current_page == $i)
-               $style = "style=\"font-size: 125%;\"";
+               $style = "style=\"font-size: 125%; text-decoration: underline;\"";
             elseif($current_page-1 == $i || $current_page+1 == $i)
                $style = "style=\"font-size: 105%;\"";
             elseif(($current_page-5 >= $i) && ($i != 1) ||
@@ -873,7 +875,7 @@ class PHPFSPOT {
          $extern_link.= "&tags=". $current_tags;
       }
       if(isset($_SESSION['from_date']) && isset($_SESSION['to_date'])) {
-         $extern_link.= "&from_date=". $_SESSION['from_date'] ."&to_date=". $_SESSION['to_date'];
+         $extern_link.= "&from_date=". $this->ts2str($_SESSION['from_date']) ."&to_date=". $this->ts2str($_SESSION['to_date']);
       }
 
       $export_link = "index.php?mode=export";
@@ -1210,12 +1212,18 @@ class PHPFSPOT {
     * getPhotoSelection() will then only return the matching
     * photos.
     */
-   public function startSearch($searchfor, $from, $to, $sort_order)
+   public function startSearch($searchfor, $sort_order, $from = 0, $to = 0)
    {
       $_SESSION['searchfor'] = $searchfor;
-      $_SESSION['from_date'] = $from;
-      $_SESSION['to_date'] = $to;
       $_SESSION['sort_order'] = $sort_order;
+      if($from != 0)
+         $_SESSION['from_date'] = strtotime($from);
+      else
+         unset($_SESSION['from_date']);
+      if($to != 0)
+         $_SESSION['to_date'] = strtotime($to);
+      else
+         unset($_SESSION['to_date']);
 
       if($searchfor != "") {
          /* new search, reset the current selected tags */
@@ -1225,6 +1233,7 @@ class PHPFSPOT {
                array_push($_SESSION['selected_tags'], $tag);
          }
       }
+
    } // startSearch()
 
    /**
@@ -1760,6 +1769,46 @@ class PHPFSPOT {
 
    } // get_random_photo()
 
+   /**
+    * validates provided date
+    *
+    * this function validates if the provided date
+    * contains a valid date and will return true 
+    * if it is.
+    */
+   public function isValidDate($date_str)
+   {
+      $timestamp = strtotime($date_str);
+   
+      if(is_numeric($timestamp))
+         return true;
+      
+      return false;
+
+   } // isValidDate()
+
+   /**
+    * timestamp to string conversion
+    */
+   private function ts2str($timestamp)
+   {
+      return strftime("%Y-%m-%d", $timestamp);
+   } // ts2str()
+
+   private function extractTags($tags_str)
+   {
+      $not_validated = split(',', $_GET['tags']);
+      $validated = array();
+
+      foreach($not_validated as $tag) {
+         if(is_numeric($tag))
+            array_push($validated, $tag);
+      }
+   
+      return $validated;
+   
+   } // extractTags()
+
 }
 
 ?>