diff --git a/.github/workflows/regression.yml b/.github/workflows/regression.yml new file mode 100644 index 0000000..3bb00ef --- /dev/null +++ b/.github/workflows/regression.yml @@ -0,0 +1,53 @@ +name: Security and workflow regressions +on: [push, pull_request, workflow_dispatch] +permissions: + contents: read +jobs: + regression: + runs-on: ubuntu-latest + timeout-minutes: 20 + services: + mariadb: + image: mariadb:11.4 + env: + MARIADB_ROOT_PASSWORD: disposable-ci-password + ports: ['3306:3306'] + options: >- + --health-cmd="healthcheck.sh --connect --innodb_initialized" + --health-interval=5s --health-timeout=5s --health-retries=20 + env: + HCR_ENVIRONMENT: Development + HCR_TEST_DSN: mysql:host=127.0.0.1;port=3306 + HCR_TEST_USER: root + HCR_TEST_PASSWORD: disposable-ci-password + HCR_DB_HOST: 127.0.0.1 + HCR_DB_PORT: 3306 + HCR_DB_USER: root + HCR_DB_PASSWORD: disposable-ci-password + HCR_APPLICATION_URL: '' + steps: + - uses: actions/checkout@v4 + - uses: shivammathur/setup-php@v2 + with: + php-version: '8.4' + extensions: pdo_mysql, dom, simplexml, xsl, mbstring, openssl, zip, gd, fileinfo, curl + tools: composer + - uses: actions/setup-node@v4 + with: + node-version: '22' + - uses: actions/setup-python@v5 + with: + python-version: '3.12' + - run: composer install --no-interaction --prefer-dist + - run: composer check-platform-reqs + - run: composer audit --locked + - run: python -m pip install lxml==6.0.2 + - run: sudo apt-get update && sudo apt-get install -y mariadb-client + - name: Install isolated test browser + run: | + npm install --prefix "$RUNNER_TEMP/hcr-browser" --ignore-scripts playwright@1.62.1 + "$RUNNER_TEMP/hcr-browser/node_modules/.bin/playwright" install --with-deps chromium + echo "NODE_PATH=$RUNNER_TEMP/hcr-browser/node_modules" >> "$GITHUB_ENV" + echo "HCR_TEST_CHROME=$(node -p "require('$RUNNER_TEMP/hcr-browser/node_modules/playwright').chromium.executablePath()")" >> "$GITHUB_ENV" + - run: python tests/run.py + - run: python bin/build-release.py "$RUNNER_TEMP/hcr-release.zip" diff --git a/.gitignore b/.gitignore index 89c1925..be00460 100644 --- a/.gitignore +++ b/.gitignore @@ -2,3 +2,4 @@ /.env /.tools/ /tests/.local/ +/tests/__pycache__/ diff --git a/.htaccess b/.htaccess index 9b0c667..7b78488 100644 --- a/.htaccess +++ b/.htaccess @@ -1,10 +1,8 @@ Options -Indexes - - RewriteEngine On - RewriteRule ^(?:classes|vendor|xml|tables|views|migrations|bin|tests|nbproject|reports)(?:/|$) - [F,L,NC] - RewriteRule (^|/)\. - [F,L] - - +RewriteEngine On +RewriteRule ^(?:classes|vendor|xml|tables|views|migrations|bin|tests|nbproject|reports|deploy)(?:/|$) - [F,L,NC] +RewriteRule (^|/)\. - [F,L] + Require all denied DirectoryIndex main.php diff --git a/AUTHENTICATION.md b/AUTHENTICATION.md index 9ae6a9d..46680b9 100644 --- a/AUTHENTICATION.md +++ b/AUTHENTICATION.md @@ -4,6 +4,11 @@ Login, signup, password changes, and password reset now use `classes/AuthService The existing PHP/XSL presentation structure is retained. Signup creates an active `User` account; it does not grant administrator access or club membership. +The October 19 update adds mailbox verification and reset-link invalidation on +account changes. Apply the newest schema before using that code; see +[production safeguard changes](PRODUCTION-FIXES.md) for migration and rollout +instructions. Ordinary club access now requires verified email ownership. + ## Before using this version against your database 1. Back up the database and use a maintenance window for the schema update. diff --git a/PRODUCTION-FIXES.md b/PRODUCTION-FIXES.md new file mode 100644 index 0000000..c9e9891 --- /dev/null +++ b/PRODUCTION-FIXES.md @@ -0,0 +1,253 @@ +# Production safeguard changes — October 19, 2026 + +This implements the production review's security defects, financial history and +corrections, protected audit writes, mailbox verification, and deployment tooling. +It does not deploy to a public host or silently change the development database. + +## Apply the new schema before running this code against an existing database + +Back up the target database, verify that the backup restores, and use a maintenance +window. With separate migration credentials and the target environment configured: + +```text +php bin/migrate-auth.php +php bin/migrate-roster.php +php bin/migrate-production.php +``` + +All three migrations are now applied to development. The production-safeguards +migration was applied there on October 20, 2026, after a fresh verified backup; +see the rollout record below. It has not been applied to a production host here. It adds +mailbox verification, financial correction/reversal tables, and payment metadata; +it enlarges journal entries, ensures transactional audit storage, and refreshes +the user view. It can be rerun. Existing financial records retain their amounts; +their previously unknown actors remain null and appear as historical records. +Schema changes can lock tables; they are CLI operations, never web requests. + +Existing addresses are not automatically marked verified. Ordinary users must +verify their email before viewing club data or receiving/reactivating membership. +They can use the new verification flow or complete a password setup/reset link. +Existing administrators retain access to administer this transition. User records, +memberships, and financial history are preserved. + +## Account security and browser dependency + +- Password-reset issuance now locks the account and compares the originally + resolved email, status, and account version. Account edits and status changes + delete outstanding reset tokens under the same account lock. This handles both + interleavings: an edit before token creation, and an edit during email delivery. +- Username/email/role/status changes invalidate reset links and verification + links. Changing an email also clears its verified status. Disable/reactivate + cannot revive a reset link. Existing session revocation remains intact. +- Replaced jQuery 3.2.0 with official jQuery 3.7.1 on current and legacy templates. + Removed the old asset. Its downloaded SHA-256 matches the official integrity + value recorded in browser-dependencies.json. Existing jQuery 3.x plugin behavior + is retained; a major-version migration is not necessary for this fix. +- Browser tests cover account creation, deletion safeguards, the alert and popover + editors, rosters, financial corrections, downloads, and verification requests. +- Fixed the garbled username validation message and normalized newly added view + text to UTF-8. + +## Financial history, corrections, and audit + +- New LedgerService coordinates dues, payments, corrections, and reversals. + Charges and payments record their actor; payments also store method/reference. +- Itemized payment history shows date, amount, member, method/reference, actor, + and reversal details. Members see only their own financial history. +- Correcting dues appends an adjustment with the previous/effective amounts, + actor, reason, and request key. It preserves the original charge. A correction + cannot reduce dues below received payments; reverse an erroneous payment first. +- Reversing a payment appends one reversal with an actor and reason. It restores + the amount owed and retains the original payment. This records a bookkeeping + correction; it does not send a refund or move money. +- Repeated payment, correction, and reversal requests are idempotent. Changed + payloads with a reused request key are rejected. Concurrent writes use account, + club, and dues locks as appropriate; overpayment is still rejected. +- Financial CSV includes effective dues, paid/balance cents, individual payments, + corrections, reversal reasons, and actors. User text is protected against + spreadsheet formula injection. Monetary calculations use integer cents. +- Financial, club, membership, season, and administrative account changes write + audit entries in the same transaction. An audit failure rolls back the change. + Entries include entity IDs and relevant before/after values, amounts, or reasons. + Passwords and tokens are never audit payloads. +- Removed the journal-clearing route, button, and handler. The legacy PHP helper + also refuses clearing. Accounts with recorded journal history are retained; + disable them instead of deleting their identity. +- Runtime grant examples allow journal inserts but deny journal update/deletion + and financial update/deletion. Migrations and backup/restore use separate roles. + Authentication audit errors continue to go to server logs without preventing + login; configure alerts on those errors. + +## Mailbox verification + +- Signup requests an email verification link and explains how to resend it. + Public requests return neutral messages for unknown, verified, rate-limited, + or undeliverable accounts. +- Links contain 256-bit random values, stored only as hashes, expire after 24 + hours, and are bound to the account email/version. Failed delivery removes the + unsent token. Expired records are handled by the cleanup CLI. +- Opening a link does not consume it. Confirmation requires POST, CSRF protection, + a valid token, and the account password. This prevents a mailbox owner from + accidentally activating an account whose password was chosen by someone else. +- Successful password setup/reset also proves ownership of its current mailbox. + Changing a known password without a delivered token does not verify an email. +- Active membership assignment requires an active, verified account. Regular + members also need verified email to read club data. Admin summaries show the + verification state and retain the password setup-link action. + +## Production configuration and release tooling + +- Remote production database connections require HCR_DB_TLS_CA. Certificate + validation is enabled and the negotiated TLS cipher is checked. Localhost/ + loopback database connections remain available; explicitly protect any local + tunnel. Production TLS must still be tested against the actual server. +- Set HCR_ENVIRONMENT=Production explicitly. That prevents automatic loading of + settings.local.xml; environment variables or an explicitly selected external + HCR_SETTINGS_FILE supply production secrets. Never package development secrets. +- HTTPS is recognized directly or from X-Forwarded-Proto only when REMOTE_ADDR is + in HCR_TRUSTED_PROXIES, a comma-separated list of exact IP addresses. The proxy + must overwrite forwarded headers and direct access to its backend must be + restricted. Untrusted and ambiguous forwarding headers are rejected. +- Application responses hide PHP errors and send CSP, frame/referrer/content-type + protections and Permissions-Policy. Production HTTPS sends HSTS. Inline scripts + and JavaScript links were replaced so script-src does not need unsafe-inline. + Inline styles remain permitted for Bootstrap/editor compatibility. +- Apache protections now require mod_rewrite rather than silently skipping the + private-directory rules. Apache needs AllowOverride support. IIS additionally + blocks sensitive file extensions. Nginx and PHP configuration examples are in + deploy/. These examples must be adapted and tested on the chosen server. +- `python bin/build-release.py /protected/releases/hcr.zip` creates a clean zip and + SHA-256 manifest from the workspace, including new files. It excludes local + settings, backups, tests, Git metadata, and IDE files. Use locked Composer + dependencies and review the archive before deployment; it is not published. +- `python bin/check-production.py https://app.myhuntingclubroster.com` performs + read-only HTTPS, header, cookie, and private-path checks after deployment. + It sends no email and changes no accounts. The actual production host was not + contacted in this change. +- `php bin/check-health.php` exits nonzero on database/schema failures. Run it + from the server monitor with production settings and alert on failures. + +## Operational setup on the hosting server + +The project now supplies the entry points; the server administrator must install +their schedule, permissions, storage, and alerts on the actual production host. +No hosting credentials or host details were supplied for that work. + +1. Provision migration, runtime, and backup accounts separately. Adapt + deploy/runtime-grants.sql.example. Keep secrets outside the document root and + restrict file access to the service/job accounts. Test the runtime role. +2. Schedule `php bin/cleanup-auth.php` daily. It removes expired reset/verification + links and stale rate-limit buckets without deleting audit history. +3. Schedule `php bin/backup-database.php /protected/backups` using backup-specific + credentials. Set HCR_DUMP_BINARY to the installed mariadb-dump executable if it + is not on PATH. The directory must exist outside the application tree. The job + writes a complete transactional SQL dump and checksum metadata and removes its + temporary credentials file. All tables must be InnoDB. It exits on failure. +4. Restrict the backup directory before running the job, especially with Windows + ACLs. Use encrypted storage and protected off-host copies, define retention and + recovery objectives, and regularly restore-test backups. The script does not + implement encryption, retention, or off-host storage by itself. +5. Alert on failed backups/cleanup/health jobs, PHP errors, audit failures, SMTP + failures, disk pressure, and database failures. Configure log rotation and + protected audit retention/archival; there is no web audit-deletion facility. +6. Run Composer platform checks and the isolated regression runner before release. + The GitHub workflow supplies a disposable MariaDB and browser; it runs when + pushed to a repository with Actions enabled. This change does not push code or + claim that GitHub CI has run. +7. Deploy the complete release during the migration window. Run host checks, then + send a real invitation/reset to a controlled mailbox and verify inbox delivery + and link completion. Local tests deliberately use simulated delivery. +8. Keep the prior release and the verified pre-migration backup. Recovery after + new financial writes needs reconciliation; do not blindly restore an old dump + and discard subsequently received entries. + +## Verification and remaining scope + +The final local run passed **308 checks plus 5 concurrency scenarios**: + +| Suite | Passed | +| --- | ---: | +| Authentication service/templates | 49 | +| Maintenance validation/pagination | 52 | +| Authentication HTTP | 27 | +| Project HTTP, ledger, exports, and access boundaries | 99 | +| Reset invalidation, verification, corrections, audit rollback, transport | 42 | +| Restricted runtime database permissions | 5 | +| Browser workflows, editors, corrections, downloads, and CSP | 21 | +| Migration, release, backup, health, and private-path tooling | 13 | +| Concurrent defaults, payments, reversal retries, correction retries, final admin | 5 scenarios | + +Source checks passed for 41 PHP files, 55 JavaScript files, 39 compiled XSL +stylesheets, and the jQuery integrity hash. IIS configuration is well-formed XML. +Composer's final locked dependency audit reported no advisories or abandoned +packages. The GitHub workflow and actual Apache/IIS/Nginx production hosts have +not been executed or contacted here. + +The verified development backup was also restored locally. After bringing the +copy to the existing roster schema, the new migration was run twice. Every +original column value across all 17 existing tables was unchanged. The isolated +restored copy was removed. That October 19 implementation run did not migrate +development; the subsequently authorized rollout is recorded below. + +Tests use generated disposable databases; they do not send real mail, move money, +or modify existing development accounts. Temporary databases and the restricted +test account were removed, and the local test server was stopped. Production TLS +certificate negotiation and real inbox delivery require the actual hosting setup. + +Global site administrators continue to manage all clubs. Active club members +continue to see their club's active contact directory. These are existing product +policies, not newly introduced club-admin roles or contact-consent settings. +Delegated club administration, MFA enrollment/recovery, online payments/refunds, +and large-scale pagination/background exports remain separate enhancements. The +production-specific TLS, web-server configuration, monitoring schedules, off-host +backup policy, and real mail delivery remain deployment acceptance work. + +## Development rollout — October 20, 2026 + +At the user's request, `bin/migrate-production.php` was applied to +`192.168.1.190/huntingclubroster` at 6:32 a.m. Eastern. The previously approved +unencrypted development connection was used. The target was checked explicitly; +no production host was changed. + +Before migration, a complete 43,100-byte backup was saved at +`.tools/backups/20261020-063143/huntingclubroster.sql`. Its SHA-256 is +`526113c2575927d33680cb696a398f59352554a5892c23c1a8ff414fe6f1e3ca`. +The backup was restored locally and its checksum and all 17 table counts matched. +Every existing column value in the original 17 development tables was checked +before and after migration and was preserved. The database now has 20 base tables. + +**48 acceptance checks passed against development**, using temporary accounts and +an owned temporary club through a local application server. They verified: + +- Verification link generation, trusted URL, POST confirmation, correct-password + enforcement, single use, stored verification state, and membership gating. +- Password reset, old-password rejection, new-password login, consumed-token + rejection, session revocation, and invalidation after an email change. +- Clearing verified state on email change and restoring club access only after a + fresh bound verification link is confirmed. +- Dues corrections preserving original charges, safe retries, correct balances, + and rejection of corrections below received payments or excess payments. +- Reversals preserving original payments, safe retries, duplicate-reversal + rejection, restored balances, and settlement with a replacement payment. +- Ordinary-member restrictions, detailed financial CSV, and audit events. + +Email issuance used the real application services and development database, with +only the delivery boundary replaced by local capture. No real emails were sent; +SMTP/inbox delivery was not retested. The public URL was checked in generated +links without requiring development to be served at that public hostname. All +payments were manual test ledger entries; no money moved. + +The first helper attempts encountered a Windows temporary-session-path parsing +issue. The helper was corrected and those temporary records were removed. During +the first complete run, an independent administrator login changed existing login +timestamps, a journal entry, and rate counters. The differences were proved to +match that login and were preserved; no original data was restored over user +activity. A final complete run finished with a clean baseline comparison across +all 20 tables. Existing accounts were not used as test accounts or reset by the +verification scripts. + +All temporary accounts, memberships, seasons, charges, payments, adjustments, +reversals, tokens, test audit/rate-limit entries, and temporary sessions were +removed. Auto-increment sequences may have advanced. A final CLI health check +passed. The local restore copy was removed and its database server stopped. +Private migration results and the check-by-check report remain beside the backup. diff --git a/PRODUCTION-REVIEW.md b/PRODUCTION-REVIEW.md new file mode 100644 index 0000000..30986f7 --- /dev/null +++ b/PRODUCTION-REVIEW.md @@ -0,0 +1,171 @@ +# Production readiness review — October 18, 2026 + +Follow-up implementation: see [PRODUCTION-FIXES.md](PRODUCTION-FIXES.md) for the +October 19 code changes, new migration, tests, and remaining host acceptance work. +The findings below describe the reviewed version before that implementation. + +Recommendation: hold production launch until the security defects and financial +recordkeeping gaps below are resolved and the production deployment checks pass. +The recent successful workflow tests remain useful, but do not cover these gaps. + +This review inspected the current source, schema, server rules, configuration, +dependencies, and deployment documentation. Composer's locked dependency audit +returned no published advisories or abandoned packages. One security defect was +reproduced using a disposable local database; that database was removed and its +server stopped. No development database records or application code were changed +during this review. The earlier 231-check suite and 54 development checks were +not rerun as part of this review. + +## 1. P1 — Revoke reset links when account security details change + +Evidence: `classes/MaintenanceService.php:110–137` revokes sessions on account +changes but leaves password reset tokens intact. `classes/AuthService.php:150–181` +accepts a token based on its user ID and expiry without binding it to the account +version or email that existed when it was issued. + +Confirmed reproduction: issue a valid token for `old@example.test`, change the +account email to `new@example.test` through MaintenanceService, then submit the +old token. The reset succeeds. Someone holding a link delivered to the old mailbox +can therefore regain access while the token remains valid, up to 30 minutes. + +Fix: invalidate existing tokens transactionally on email and other security changes; +bind issued tokens to the relevant account version so concurrent issuance cannot +leave an old token valid. Cover email changes, disable/reactivate, role changes, +and concurrent reset issuance with regression tests. + +## 2. P1 — Replace the vulnerable browser dependency + +Evidence: `xsl/content.xsl:41`, `xsl/login.xsl:36`, and +`xsl/createAccount.xsl:37` load `js/jquery-3.2.0.min.js`. + +This version predates fixes for published cross-site scripting vulnerabilities in +HTML manipulation. The upstream advisories describe vulnerable operations and +affected versions; this review does not claim a demonstrated application exploit. +Composer audit does not cover bundled JavaScript files. + +Fix: select a patched, supported jQuery version, review the bundled plugins for +compatibility, and rerun browser tests. Track browser dependencies in a manifest +and include them in dependency checks. + +Primary sources: +- https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2 +- https://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6 +- https://jquery.com/upgrade-guide/3.5/ + +## 3. P1 — Complete financial history and corrections before real dues use + +Evidence: `classes/Roster.php:66–71` displays charges, summed payments, and balances, +but no itemized payment history. `classes/RosterService.php:62–79` supports inserting +charges and payments, without a correction, void, or reversal workflow. +`migrations/002_roster.sql:30–49` has no recorded-by actor, correction reason, or +payment reference fields. + +A payment or charge entered incorrectly currently requires direct database work. +The user also cannot inspect each payment's date and details in the application. + +Fix: add itemized payment history and financial export/reconciliation; record who +entered each item and a reference/method where appropriate; implement permissioned, +audited adjustments or reversals that preserve the original entry. Test balance +recalculation, repeated requests, and concurrent corrections. This concerns the +manual ledger already in scope; online payment processing is a separate feature. + +## 4. P1/P2 — Preserve and complete the audit trail + +Evidence: `classes/Journal.php:38–44` lets an administrator truncate the complete +journal. `classes/RosterService.php:44–61` does not audit membership or season +changes. Financial messages at lines 67 and 77 omit amounts and the new financial +record's ID. `classes/Audit.php:3–7` catches write failures; financial writes commit +before their audit messages are attempted. Administrative account changes also +lack corresponding detailed audit entries. + +Consequences: changing club access may leave no journal event, and the journal +can be erased. A financial save can succeed while its audit record is lost. + +Fix: remove unrestricted journal clearing, define retention and protected archival, +record actor/entity/before-and-after details for privileged changes, and write +financial audit events in the same transaction or a transactional outbox. Keep +authentication available if its logging backend fails, with failure monitoring. + +## 5. P2 — Verify email ownership before relying on it for club access + +Evidence: `classes/AuthService.php:86–113` immediately activates a self-registered +account without verifying its mailbox. `classes/RosterService.php:44–55` assigns +membership to an existing username or email with no verified-email check. + +An account can be registered using someone else's email. Signup alone does not +grant membership, but an administrator assigning that expected email could select +an account controlled by the wrong person. + +Fix: implement mailbox verification or an invitation acceptance flow, and require +verified identity before assignment by email. Email changes should require fresh +verification and invalidate outstanding reset links. Until then, an explicit +independent identity-check procedure is needed for assignments. + +## 6. Release gate — Verify production isolation, transport, and secrets + +These are deployment checks, not claims that a public leak currently exists. + +- `classes/Base.php:145–153` has no database TLS certificate/verification options. + The approved non-TLS development connection does not establish a production + transport design. If production uses a remote database, configure verified TLS + or an explicitly secured private transport; use a restricted runtime database + account and a separate migration account. +- `classes/Base.php:432–440` automatically prefers `xml/settings.local.xml` before + environment overrides. Build a clean production artifact that excludes local + secrets, `.tools` backups and control files, `.git`, tests, and IDE files. + Current workspace changes include untracked application classes and migrations; + ensure the release captures every required file. +- Apache private-directory rules depend on rewrite configuration. IIS and the + development router have different rules; no Nginx configuration is provided. + Verify private paths and backup filenames return a denial on the actual host. + Prefer placing private code, secrets, and backups outside the document root. +- `main.php:20–30` detects HTTPS only through `$_SERVER['HTTPS']`. If TLS terminates + at a proxy, configure a trusted proxy/server arrangement; otherwise HTTPS + visitors can be rejected or cookies can be misconfigured. Do not trust arbitrary + client-supplied forwarding headers. +- Confirm production environment mode, secure cookies, PHP error-display settings, + HTTPS enforcement, and secret provisioning. Add HSTS at the HTTPS server and a + tested Content Security Policy; the latter needs work on inline scripts and + existing JavaScript links. +- Perform a production-host invitation/reset test using the configured application + URL and sender. Earlier SMTP acceptance and local tests do not establish inbox + delivery or the final hosting setup. This review did not test production DNS. + +## 7. Release gate — Make backup, monitoring, and deployment repeatable + +The verified manual backups prove a backup can be restored; the repository does +not demonstrate an automated production backup/restore policy, alerting setup, or +release pipeline. These may exist outside the project and should be verified. + +Before launch: +- Schedule protected backups outside the application document root, define + retention and recovery objectives, and periodically restore-test them. +- Monitor application failures, audit failures, SMTP delivery, database health, + disk capacity, and failed backup jobs. +- Schedule `bin/cleanup-auth.php` as documented; ensure scheduled jobs use the + correct environment and credentials. +- Create a reproducible release with platform-requirement checks, dependency + audits, isolated regression tests, migration verification, and a recovery plan. +- Test representative roster sizes. Club rosters/dues and exports currently load + complete result sets; large clubs need paging, query/performance testing, and + export limits or background generation as appropriate. + +## Product decisions and lower-priority improvements + +- All club management currently belongs to global site administrators, who can + access every club. This matches the implemented scope. If each club will manage + itself, scoped club-administrator roles and cross-club authorization tests are + needed before that operating model launches. +- Active members can see their club's other active members' email addresses + (`RosterService.php:22–24`). Confirm that this is the intended directory/privacy + policy; consider restricted visibility or opt-in contacts. +- Add MFA and recent-password confirmation for sensitive administrator actions. + These are additional protections, not a claim that current session checks fail. +- Add season editing with history, clearer payment error recovery, keyboard/mobile + usability checks, and repair the garbled username validation text in + `AuthService.php:95`. These should follow the security and ledger work. + +Recommended order: reset-token invalidation; browser dependency update; durable +financial history/corrections and audit; verified identity; production deployment +and operational verification. Resolve the club-administration and directory-privacy +decisions before enabling real club users. diff --git a/PROJECT-REPAIRS.md b/PROJECT-REPAIRS.md new file mode 100644 index 0000000..482eaab --- /dev/null +++ b/PROJECT-REPAIRS.md @@ -0,0 +1,194 @@ +# Project repairs and multi-club setup + +Implemented and tested October 18, 2026. Existing authentication work is described +in [AUTHENTICATION.md](AUTHENTICATION.md). + +## Database rollout + +The roster migration was applied to the development database on October 18, 2026, +after the implementation tests and a fresh, verified backup. The development +verification is recorded below. Existing accounts and passwords were preserved. + +After backing up the target database, run from the project directory with the +application's database configuration and PHP runtime: + +```text +php bin/migrate-roster.php +``` + +The migration adds five InnoDB tables: clubs, memberships, seasons, dues, and +payments. It preserves existing records, can be rerun, and uses foreign keys to +prevent orphan records and cross-club dues assignments. It does not rebuild the +database. The authentication migration remains a prerequisite for this version; +it was already applied to development during the earlier authentication work. + +The existing backup was restored locally, its SHA-256 and all ten original table +counts were checked, then both migrations were rehearsed. Running the roster +migration twice preserved all ten original counts. The restored copy was removed. +On other installations, until the roster migration is applied, the home page +explains that setup is needed. + +Use the PHP version and Composer requirements in AUTHENTICATION.md. Report tests +used the curl, zip, gd, fileinfo, mbstring, openssl, PDO MySQL, and XSL extensions. +Run Composer's platform requirements check with the web server's PHP configuration. + +## Security and deletion safeguards + +- Dropdown usage metadata no longer selects arbitrary PHP callbacks or SQL + identifiers. Only the supported no-reference rule is accepted; unsupported + legacy rules fail closed rather than exposing settings or allowing deletion. +- IDs and booleans are validated, and dropdown writes use bound parameters. + A dropdown must belong to the requested type and be active to become default. + Switching defaults is transactional and serialized by type. Deactivation clears + the default. Default dropdowns and types containing dropdowns cannot be deleted. +- Account deletion, disablement, and role changes protect the last active + administrator, including simultaneous requests. Administrators cannot delete + themselves; ordinary administrators cannot modify System Administrator accounts. + Accounts with notes or club memberships must be retained. Reset tokens are + removed transactionally when an otherwise unused account is deleted. +- Status saves validate fields and enforce at most one default; inactive defaults + and deletion of the current default are rejected. Removed dependencies on + nonexistent requests and workorders tables from usage checks. +- Notes validate type, text, target, and existing note on the server. Target user + locks coordinate note creation with account deletion. Queries are bound and + displayed note text is escaped. +- Routing allows only supported actions, with administrative access enforced on + maintenance and exports. Removed arbitrary helper dispatch and obsolete report + dispatch. Failures return meaningful HTTP statuses and escaped messages; + AJAX no longer treats an empty successful write as invalid JSON. + +## Accounts, lists, navigation, and browser behavior + +- Administrative account creation validates first and last names, username, + email, and role. It stores an unknown random hashed password and sends a setup + link. A mail failure reports that the account exists and offers a resend path; + retrying cannot silently duplicate the account. No temporary password is exposed. +- Repaired account summaries, notes, and login history without the missing + Subscriptions dependency. Corrected username lookup and invitation resend. +- Restored audit entries for successful login, reset requests, password resets, + and password changes; club saves, dues, and payments also write journal entries. + Audit write errors are logged without breaking authentication. +- Pagination now uses correct last-page offsets, stable ordering, bounded page + sizes, empty-list handling, and independent state per list. Fixed incorrect + per-page fields, added status page-size refresh, escaped search patterns, and + added last-name account search and display. +- Replaced dead permit, zoning, subscription, support-ticket, and payment links + with Clubs and dues, Help, and a working report catalog. Retired three legacy + permit report implementations and obsolete metrics dependencies. +- Converted synchronous browser requests to asynchronous requests and fixed their + callers. Save/confirmation controls wait for requests, errors appear visibly, + and failed deletion checks never open a confirmation dialog. Default-checkbox + failures restore the prior selection. +- Hidden form inputs are built as DOM text values; toast and error content use + text rendering. Cached form restoration excludes hidden routing fields, IDs, + CSRF tokens, and passwords. Fixed ZIP lookup routing, logout request handling, + tooltip initialization, and jQuery callback compatibility. + +## Multi-club roster features + +- Site administrators create, rename, archive, and reactivate multiple clubs. + They assign existing accounts to separate club memberships, maintain membership + status and joined dates, and add dated seasons. +- Ordinary members see active clubs to which they have active membership, their + club's active contact roster, and only their own dues. Changing a URL or form ID + cannot grant access to another club. Membership changes take effect in existing + sessions. Signup alone grants no club membership. +- Administrators record season dues and received payments in a **manual USD + ledger**. Amounts use integer cents, reject fractional cents and negative values, + and payments cannot exceed the remaining balance. Repeated payment submissions + use an idempotency key to avoid duplicate entries. Dates and club relationships + are checked on the server. +- Archiving retains membership and financial history and prevents further writes + until reactivation. History is not exposed through destructive delete controls. +- Administrators can export a club roster as CSV, Excel, or PDF. Spreadsheet + formula injection is neutralized, Excel cells are explicit text, and PDF fields + are escaped. + +This is a multi-club foundation managed by global site administrators. It does not +provide delegated club administrators, online payment processing, refunds, ledger +correction workflows, or automatic billing. These are separate features. + +## Verification + +All final suites passed against generated disposable local databases: + +| Suite | Result | +| --- | --- | +| Authentication service and templates | 49 checks | +| Authentication HTTP routes | 27 checks | +| Maintenance validation and pagination units | 52 checks | +| Project HTTP, access boundaries, ledger, exports, and paging | 88 checks | +| Headless Chrome workflows | 15 checks | +| Concurrent default and administrator updates | 2 scenarios | + +Total: **231 checks plus 2 concurrency scenarios**. Browser tests verified account +creation, visible invitation failure, account summary, blocked and successful +deletion, restricted dropdown metadata, club/membership/season creation, dues, +payments, and CSV download without unexpected JavaScript errors. Mail failure was +deliberately simulated; this round did not retest real delivery. + +Source checks also passed for 24 application PHP classes, four CLI scripts, four +PHP test scripts, main.php, 54 JavaScript files, and 39 compiled XSL stylesheets. +All disposable databases were cleaned up and the isolated database server stopped. + +Tests require an explicitly configured isolated MySQL/MariaDB server through +`HCR_TEST_DSN`, `HCR_TEST_USER`, and `HCR_TEST_PASSWORD`. HTTP tests additionally +require matching `HCR_DB_HOST`, `HCR_DB_PORT`, `HCR_DB_USER`, and `HCR_DB_PASSWORD`. +`PHP_TEST_COMMAND` accepts a JSON argument array for the test PHP runtime. +`NODE_TEST_COMMAND` selects Node and `NODE_PATH` locates Playwright for browser +tests. Do not point these tests at the application database. + +```text +php tests/auth_integration.php +php tests/maintenance_unit.php +python tests/auth_http.py +python tests/project_http.py +python tests/concurrency.py +python tests/browser_runner.py +``` + +These tests cover application behavior in isolation; deployment still needs the +new migration on any other target and validation with its actual PHP, HTTPS, and +mail configuration. + +## Development database rollout and verification + +At the user's request, the roster migration was applied to +`192.168.1.190/huntingclubroster` on October 18, 2026 at 8:23 p.m. Eastern. +The previously approved unencrypted database connection was used. + +Before migration, a fresh complete SQL backup was saved at +`.tools/backups/20261018-202150/huntingclubroster.sql` (37,317 bytes). Its SHA-256 is +`f4458cce64404063d9760c2fe06f9779cf8904c0dc27d301541b24486382157a`. +The backup was restored on an isolated local server; the checksum and row counts +for all 12 original tables matched. All existing rows were fingerprinted before +and after migration and were unchanged. Five new roster tables are ready. + +Then **54 checks passed against the development database**, through a local HTTP +application server using three temporary accounts, two temporary clubs, separate +memberships, three dues records, and received payments. The checks covered: + +- Creating multiple clubs, seasons, and memberships, including one account in two + clubs and rejection of duplicate memberships and dues. +- Membership and season boundaries, member financial privacy, administrative + permissions, CSRF enforcement, and protection against account deletion. +- Exact cents, partial payments, correct balances, idempotent payment retries, + changed-key-payload rejection, overpayment rejection, and full settlement. +- Immediate access revocation for inactive membership or archived clubs, blocked + writes while archived, and successful reactivation with preserved ledger data. +- Valid CSV, Excel, and PDF downloads. + +An initial verification-helper session setup error was corrected before the +successful run; its temporary records were also removed. This required no change +to application code. + +All temporary accounts, club records, dues, payments, test audit entries, rate +limit records, and sessions were removed afterward. Every row across all 17 +tables matched the pre-test fingerprint. Auto-increment sequences may have +advanced during testing. No existing passwords were changed and no emails or +online payment transactions were sent. These are manually recorded payments. + +Private backup metadata, migration results, and the check-by-check verification +report are retained alongside the backup in `.tools/backups/20261018-202150/`. +That directory is ignored by Git and blocked by the development router. The local +restore copy was removed and the isolated local database server stopped. diff --git a/README.md b/README.md index fa3e5cf..8a0ec18 100644 --- a/README.md +++ b/README.md @@ -3,3 +3,9 @@ See [authentication setup and changes](AUTHENTICATION.md) before deploying the updated login, signup, and password reset flows. The authentication migration must be applied to the existing database before using this version. + +See [project repairs and multi-club setup](PROJECT-REPAIRS.md) for the security +fixes, new roster migration, feature scope, and verification results. + +See [production safeguard changes](PRODUCTION-FIXES.md) for the newest migration, +verified-email requirement, ledger corrections, and deployment instructions. diff --git a/bin/backup-database.php b/bin/backup-database.php new file mode 100644 index 0000000..ab39689 --- /dev/null +++ b/bin/backup-database.php @@ -0,0 +1,28 @@ +getSettings();$db=$base->connect(); +$engines=$db->query("SELECT ENGINE FROM information_schema.TABLES WHERE TABLE_SCHEMA=DATABASE() AND TABLE_TYPE='BASE TABLE'")->fetchAll(PDO::FETCH_COLUMN); +if(array_filter($engines,static fn($v)=>$v!=='InnoDB'))throw new RuntimeException('Nontransactional tables require a maintenance-window locked backup.'); +$file=$directory.DIRECTORY_SEPARATOR.'hcr-'.gmdate('Ymd-His').'-'.bin2hex(random_bytes(3)).'.sql'; +$partial=$file.'.partial';$handle=fopen($partial,'x');if(!$handle)throw new RuntimeException('Cannot create protected backup output.');fclose($handle);chmod($partial,0600); +$config=tempnam($directory,'hcr-connection-');chmod($config,0600); +$quote=static fn($value)=>'"'.str_replace(["\\",'"',"\r","\n"],["\\\\",'\\"','\\r','\\n'],(string)$value).'"'; +$options="[client]\nhost=".$quote($settings->DatabaseServer)."\nport=".(int)($settings->DatabasePort??3306)."\nuser=".$quote($settings->DatabaseUser)."\npassword=".$quote($settings->DatabasePassword)."\n"; +$ca=getenv('HCR_DB_TLS_CA');if($ca)$options.='ssl-ca='.$quote($ca)."\nssl-verify-server-cert\n"; +try{ + file_put_contents($config,$options); + $command=[getenv('HCR_DUMP_BINARY')?:'mariadb-dump','--defaults-extra-file='.$config,'--single-transaction','--quick','--routines','--events','--triggers','--hex-blob','--databases',(string)$settings->DatabaseName,'--result-file='.$partial]; + $process=proc_open($command,[0=>['pipe','r'],1=>['pipe','w'],2=>['pipe','w']],$pipes); + if(!is_resource($process))throw new RuntimeException('Backup process could not start.'); + fclose($pipes[0]);$out=stream_get_contents($pipes[1]);$error=stream_get_contents($pipes[2]);fclose($pipes[1]);fclose($pipes[2]); + if(proc_close($process)!==0){error_log('Backup process failed: '.$error);throw new RuntimeException('Backup failed; inspect the protected backup error log.');} + if(!is_file($partial)||filesize($partial)<100||!str_contains(file_get_contents($partial),'Dump completed on'))throw new RuntimeException('Backup completion could not be confirmed.'); + if(!rename($partial,$file))throw new RuntimeException('Cannot finalize completed backup.'); + chmod($file,0600); + $metadata=['created_utc'=>gmdate(DATE_ATOM),'bytes'=>filesize($file),'sha256'=>hash_file('sha256',$file)];file_put_contents($file.'.json',json_encode($metadata,JSON_PRETTY_PRINT));chmod($file.'.json',0600); + echo json_encode(['backup'=>$file]+$metadata),"\n"; +}finally{if(is_file($config))unlink($config);if(is_file($partial))unlink($partial);} diff --git a/bin/build-release.py b/bin/build-release.py new file mode 100644 index 0000000..a14a8f3 --- /dev/null +++ b/bin/build-release.py @@ -0,0 +1,27 @@ +"""Build a clean deployment zip from current workspace files, including new files.""" +import argparse,hashlib,json,zipfile +from pathlib import Path + +ROOT=Path(__file__).resolve().parents[1] +parser=argparse.ArgumentParser();parser.add_argument('output',type=Path);args=parser.parse_args() +output=args.output.resolve() +if output.exists():raise SystemExit('Output already exists; choose a new release filename.') +files=[] +for directory in ['classes','css','images','js','html','migrations','reports','vendor','views','xsl']: + for file in (ROOT/directory).rglob('*'): + if file.is_file() and not file.is_symlink() and file.suffix.lower() not in ['.sql','.php','.js','.css','.xsl'] and directory not in ['vendor','images','css','html']:continue + if file.is_file() and not file.is_symlink() and not any(p.startswith('.') for p in file.relative_to(ROOT).parts) and '_orig.' not in file.name:files.append(file) +for name in ['main.php','.htaccess','web.config','composer.json','composer.lock','xml/settings.xml','xml/constants.xml']: + files.append(ROOT/name) +for name in ['migrate-auth.php','migrate-roster.php','migrate-production.php','cleanup-auth.php','check-production.py','backup-database.php','check-health.php']: + file=ROOT/'bin'/name + if file.exists():files.append(file) +if not (ROOT/'vendor/autoload.php').is_file():raise SystemExit('Install locked Composer dependencies before building a release.') +manifest={file.relative_to(ROOT).as_posix():hashlib.sha256(file.read_bytes()).hexdigest() for file in sorted(set(files))} +for name in manifest: + if name.startswith(('.tools/','.git/','tests/','nbproject/')) or name.endswith('settings.local.xml'):raise SystemExit('Private file would enter the release.') +output.parent.mkdir(parents=True,exist_ok=True) +with zipfile.ZipFile(output,'x',zipfile.ZIP_DEFLATED) as archive: + for name in manifest:archive.writestr(name,(ROOT/name).read_bytes()) + archive.writestr('release-manifest.json',json.dumps(manifest,indent=2)) +print(json.dumps({'release':str(output),'files':len(manifest),'sha256':hashlib.sha256(output.read_bytes()).hexdigest()})) diff --git a/bin/check-health.php b/bin/check-health.php new file mode 100644 index 0000000..ae0e0e0 --- /dev/null +++ b/bin/check-health.php @@ -0,0 +1,9 @@ +connect();$db->query('SELECT 1')->fetchColumn(); + if(!(new RosterService())->ready())throw new RuntimeException('Required schema is missing.'); + foreach(['user_email_verified_at'] as $column){$columns=$db->query('SHOW COLUMNS FROM users')->fetchAll(PDO::FETCH_COLUMN);if(!in_array($column,$columns,true))throw new RuntimeException('Account schema is missing.');} + echo "Database and required application schema are available.\n"; +}catch(Throwable $e){fwrite(STDERR,"Health check failed. Review the protected server logs.\n");error_log((string)$e);exit(1);} diff --git a/bin/check-production.py b/bin/check-production.py new file mode 100644 index 0000000..1fda972 --- /dev/null +++ b/bin/check-production.py @@ -0,0 +1,22 @@ +"""Read-only checks of a deployed HTTPS host; never sends account email or writes data.""" +import argparse,http.cookiejar,ssl,urllib.error,urllib.parse,urllib.request +parser=argparse.ArgumentParser();parser.add_argument('url');args=parser.parse_args() +url=args.url.rstrip('/');parts=urllib.parse.urlsplit(url) +if parts.scheme!='https' or parts.query or parts.fragment or parts.username:raise SystemExit('Use the trusted HTTPS application base URL.') +client=urllib.request.build_opener(urllib.request.HTTPCookieProcessor(http.cookiejar.CookieJar()),urllib.request.HTTPSHandler(context=ssl.create_default_context())) +def get(path): + try: + with client.open(url+'/'+path,timeout=25) as response:return response.status,response.headers,response.read(),response.geturl() + except urllib.error.HTTPError as error:return error.code,error.headers,error.read(),error.geturl() +failures=[] +status,headers,body,final=get('main.php') +if status!=200 or urllib.parse.urlsplit(final).scheme!='https':failures.append('HTTPS login page unavailable.') +for name in ['Strict-Transport-Security','Content-Security-Policy','X-Content-Type-Options','Referrer-Policy','X-Frame-Options']: + if not headers.get(name):failures.append('Missing '+name) +cookie=';'.join(headers.get_all('Set-Cookie') or []) +if not all(flag in cookie.lower() for flag in ['secure','httponly','samesite=lax']):failures.append('Session cookie flags are missing.') +for path in ['xml/settings.local.xml','xml/settings.xml','.tools/backups/probe.sql','.git/config','vendor/autoload.php','bin/migrate-production.php','classes/Base.php','tests/http_fixture.php','composer.lock','release-manifest.json']: + if get(path)[0] not in [403,404]:failures.append('Private path was not denied: '+path) +for failure in failures:print('FAIL: '+failure) +if failures:raise SystemExit(1) +print('HTTPS, security headers, cookies, and private-path checks passed. Verify inbox delivery and operational jobs separately.') diff --git a/bin/cleanup-auth.php b/bin/cleanup-auth.php index 77585c0..52745ad 100644 --- a/bin/cleanup-auth.php +++ b/bin/cleanup-auth.php @@ -3,5 +3,6 @@ if (PHP_SAPI !== 'cli') { http_response_code(404); exit; } require_once __DIR__ . '/../classes/Base.php'; $db = (new Base())->connect(); $db->exec('DELETE FROM password_resets WHERE expires_at < UTC_TIMESTAMP()'); +$db->exec('DELETE FROM email_verifications WHERE expires_at < UTC_TIMESTAMP()'); $db->exec('DELETE FROM auth_attempts WHERE window_started < DATE_SUB(UTC_TIMESTAMP(), INTERVAL 1 DAY)'); echo "Expired authentication records removed.\n"; diff --git a/bin/migrate-production.php b/bin/migrate-production.php new file mode 100644 index 0000000..c547a2b --- /dev/null +++ b/bin/migrate-production.php @@ -0,0 +1,22 @@ +connect(); +foreach([ + 'users'=>['user_email_verified_at'=>'DATETIME NULL'], + 'club_dues'=>['recorded_by'=>'BIGINT UNSIGNED NULL'], + 'club_payments'=>['recorded_by'=>'BIGINT UNSIGNED NULL','payment_method'=>"VARCHAR(20) NOT NULL DEFAULT 'unspecified'",'payment_reference'=>"VARCHAR(100) NOT NULL DEFAULT ''"], +] as $table=>$columns){ + $existing=$db->query('SHOW COLUMNS FROM `'.$table.'`')->fetchAll(PDO::FETCH_COLUMN); + foreach($columns as $column=>$definition)if(!in_array($column,$existing,true))$db->exec('ALTER TABLE `'.$table.'` ADD COLUMN `'.$column.'` '.$definition); +} +// Mandatory audit writes must participate in financial transactions. +$db->exec('ALTER TABLE journal ENGINE=InnoDB'); +$db->exec('ALTER TABLE journal MODIFY journal_entry TEXT NULL'); +foreach(['club_dues','club_payments'] as $table){ + $stmt=$db->prepare("SELECT COUNT(*) FROM information_schema.KEY_COLUMN_USAGE WHERE TABLE_SCHEMA=DATABASE() AND TABLE_NAME=? AND COLUMN_NAME='recorded_by' AND REFERENCED_TABLE_NAME='users'");$stmt->execute([$table]); + if(!(int)$stmt->fetchColumn())$db->exec('ALTER TABLE `'.$table.'` ADD FOREIGN KEY (recorded_by) REFERENCES users(user_serial) ON DELETE RESTRICT'); +} +foreach(explode(';',file_get_contents(__DIR__.'/../migrations/003_production.sql')) as $sql)if(trim($sql))$db->exec($sql); +require __DIR__.'/../views/view_users.php';$db->exec(str_replace('create view','CREATE OR REPLACE VIEW',$SQL)); +echo "Production safeguards schema is ready. Existing emails remain unverified until ownership is proven.\n"; diff --git a/bin/migrate-roster.php b/bin/migrate-roster.php new file mode 100644 index 0000000..10d6a3c --- /dev/null +++ b/bin/migrate-roster.php @@ -0,0 +1,6 @@ +connect(); +foreach(explode(';',file_get_contents(__DIR__.'/../migrations/002_roster.sql')) as $sql){if(trim($sql))$db->exec($sql);} +echo "Club roster schema is ready. Existing accounts and administrative records were preserved.\n"; diff --git a/browser-dependencies.json b/browser-dependencies.json new file mode 100644 index 0000000..c7b2a3e --- /dev/null +++ b/browser-dependencies.json @@ -0,0 +1,11 @@ +{ + "jquery": { + "version": "3.7.1", + "file": "js/jquery-3.7.1.min.js", + "source": "https://code.jquery.com/jquery-3.7.1.min.js", + "sha256_base64": "/JqT3SQfawRcv/BIHPThkBvs0OEvtFFmqPF/lYI/Cxo=", + "upgrade_note": "Patched jQuery 3.x retained for compatibility with the existing Bootstrap plugins; browser regressions required for future upgrades." + }, + "bootstrap": {"file": "js/bootstrap.bundle.min.js", "version": "5.3.8"}, + "bootstrap-datepicker": {"file": "js/bootstrap-datepicker.min.js", "version": "1.9.0"} +} diff --git a/classes/AdminAccounts.php b/classes/AdminAccounts.php new file mode 100644 index 0000000..ae3c6b5 --- /dev/null +++ b/classes/AdminAccounts.php @@ -0,0 +1,39 @@ + 128 || strlen($last) > 128 || !filter_var($email, FILTER_VALIDATE_EMAIL) || strlen($email) > 100 || !preg_match('/\A[A-Za-z0-9_.-]{3,64}\z/', $name) || !in_array($role, ['User', 'Guest', 'Administrator'], true)) + throw new AppException('Enter a valid username, first/last name, email and role.'); + $db = $this->connect(); + $stmt = $db->prepare('SELECT user_serial FROM users WHERE user_name IN (?,?) OR user_email IN (?,?)'); + $stmt->execute([$name, $email, $email, $name]); + if ($stmt->fetch()) + throw new AppException('An account already uses those details. Use the existing account or resend its invitation.', 409); + $db->beginTransaction(); + try { + $stmt = $db->prepare("INSERT INTO users(user_name,user_first_name,user_last_name,user_email,user_password_hash,user_role,user_status,user_change_password,user_creator) VALUES(?,?,?,?,?,?,'active',1,?)"); + $stmt->execute([$name, $first, $last, $email, password_hash(bin2hex(random_bytes(24)), PASSWORD_DEFAULT), $role, $_SESSION[self::USER_NAME] ?? '']); + $id = (int) $db->lastInsertId(); + Audit::required($db, (int) ($_SESSION[self::USER_SERIAL] ?? 0), 'created account ' . json_encode(['user' => $id, 'name' => $name, 'role' => $role])); + $db->commit(); + } catch (Throwable $e) { + if ($db->inTransaction()) + $db->rollBack();throw $e; + } + $warning = ''; + try { + if (!(new AuthService())->requestReset($email)) + $warning = 'Account created, but the invitation is rate limited. Open the user summary to resend it later.'; + } catch (Throwable $e) { + error_log('Invitation delivery failed: ' . $e->getMessage()); + $warning = 'Account created, but its invitation could not be sent. Open the user summary to resend it after checking email settings.'; + } + return ['ok' => true, 'user_serial' => $id, 'message' => 'Account created.', 'warning' => $warning]; + } +} diff --git a/classes/Alerts.php b/classes/Alerts.php index 9d14542..895adec 100644 --- a/classes/Alerts.php +++ b/classes/Alerts.php @@ -28,7 +28,7 @@ class Alerts extends Base { $this->current_user_name = $_SESSION[self::USER_NAME] ?? ""; $this->current_user_email = $_SESSION[self::USER_EMAIL] ?? ""; - $this->pagination_page = $_SESSION[self::PAGINATION_PAGE] ?? 1; + $this->pagination_page = 1; } // ============ @@ -267,7 +267,7 @@ class Alerts extends Base { // Find Criteria $find_alert = filter_input(INPUT_POST, "find_alert") ?: ""; - $find_words = $this->sanitizeString($find_alert); + $find_words = preg_quote(trim($find_alert)); // Show Per Page @@ -295,28 +295,17 @@ class Alerts extends Base { $pagination = filter_input(INPUT_POST, "pagination") ?: ""; - switch ($pagination) { - - case "first" : $this->pagination_page = 1; - break; - case "previous" : $this->pagination_page = max(($this->pagination_page - 1), 1); - break; - case "next" : $this->pagination_page = ($this->pagination_page + 1); - break; - case "last" : $this->pagination_page = ($count / $this->pagination_size); - break; - } - - $offset = (($this->pagination_page * $this->pagination_size) - $this->pagination_size); - $start = ($offset + 1); - $end = min($count, (($start + $this->pagination_size) - 1)); + $paging=Pagination::session(__METHOD__,$count,(int)$this->pagination_size,$pagination); + $this->pagination_size=$paging['size'];$this->pagination_page=$paging['page']; + $offset=$paging['offset'];$start=$paging['start'];$end=$paging['end']; // Data $SQL = "select view_alerts.* from view_alerts where alert_title regexp :alert_title - limit {$this->pagination_size} + order by alert_serial + limit {$this->pagination_size} offset {$offset}"; $statement = $connection->prepare($SQL); @@ -334,7 +323,6 @@ class Alerts extends Base { $alerts->addAttribute("end", $end); $alerts->addAttribute("page", $this->pagination_page); - $_SESSION[self::PAGINATION_PAGE] = $this->pagination_page; return $alerts; } diff --git a/classes/AppException.php b/classes/AppException.php new file mode 100644 index 0000000..af2edbe --- /dev/null +++ b/classes/AppException.php @@ -0,0 +1,4 @@ +getMessage()); + } + } + + public static function required(PDO $db, int $user, string $event): void { + if (!$db->inTransaction()) + throw new LogicException('Required audit writes need a transaction.'); + self::insert($db, $user, $event); + } + + public static function insert(PDO $db, int $user, string $event): void { + $stmt = $db->prepare('INSERT INTO journal(journal_origin,journal_ip,journal_entry) VALUES(?,?,?)'); + $stmt->execute([(string) $user, $_SERVER['REMOTE_ADDR'] ?? '', $user . ' ' . $event]); + } +} diff --git a/classes/AuthService.php b/classes/AuthService.php index 32e0057..5838c6d 100644 --- a/classes/AuthService.php +++ b/classes/AuthService.php @@ -61,6 +61,7 @@ class AuthService extends Base { $_SESSION['csrf_token'] = bin2hex(random_bytes(32)); $stmt = $this->connect()->prepare('UPDATE users SET user_last_login = :now WHERE user_serial = :id'); $stmt->execute([':now' => $this->getTimestamp(), ':id' => $user['user_serial']]); + Audit::record($this->connect(),(int)$user['user_serial'],'logged in ('.$user['user_role'].')'); return true; } @@ -92,7 +93,7 @@ class AuthService extends Base { if (!filter_var($email, FILTER_VALIDATE_EMAIL) || strlen($email) > 100) throw new InvalidArgumentException('Enter a valid email address (up to 100 bytes).'); if (!preg_match('/\A[A-Za-z0-9_.-]{3,64}\z/', $name)) - throw new InvalidArgumentException('Use 3–64 letters, numbers, dots, underscores or hyphens for your username.'); + throw new InvalidArgumentException('Use 3 to 64 letters, numbers, dots, underscores or hyphens for your username.'); $error = self::passwordError($input['user_password'] ?? '', $input['user_password_confirm'] ?? ''); if ($error) throw new InvalidArgumentException($error); @@ -113,14 +114,14 @@ class AuthService extends Base { } /** Never modify the password when somebody merely requests an email. */ - public function requestReset(string $identifier): void { + public function requestReset(string $identifier): bool { $ipAllowed = $this->allowAttempt('reset-ip', $_SERVER['REMOTE_ADDR'] ?? '', 10, 3600); $accountAllowed = $this->allowAttempt('reset-account', $identifier, 3, 3600); if (!$ipAllowed || !$accountAllowed) - return; + return false; $user = $this->findUser($identifier); if (!$user || $user['user_status'] !== 'active') - return; + return false; $baseUrl = rtrim((string) $this->getSettings()->ApplicationUrl, '/'); if (!filter_var($baseUrl, FILTER_VALIDATE_URL) || parse_url($baseUrl, PHP_URL_SCHEME) !== 'https' || parse_url($baseUrl, PHP_URL_QUERY) !== null || parse_url($baseUrl, PHP_URL_FRAGMENT) !== null @@ -129,15 +130,27 @@ class AuthService extends Base { } $token = bin2hex(random_bytes(32)); $db = $this->connect(); - $stmt = $db->prepare('INSERT INTO password_resets (token_hash, user_serial, expires_at) VALUES (:hash, :id, DATE_ADD(UTC_TIMESTAMP(), INTERVAL 30 MINUTE))'); $hash = hash('sha256', $token); - $stmt->execute([':hash' => $hash, ':id' => $user['user_serial']]); + $db->beginTransaction(); + try { + // Share the user-row lock with account edits and password changes. A + // request resolved before such a change must not mint a token afterward. + $stmt=$db->prepare('SELECT user_email,user_status,user_auth_version FROM users WHERE user_serial=? FOR UPDATE'); + $stmt->execute([$user['user_serial']]);$current=$stmt->fetch(); + if(!$current || $current['user_status']!=='active' || $current['user_email']!==$user['user_email'] || (int)$current['user_auth_version']!==(int)$user['user_auth_version']){ + $db->rollBack();return false; + } + $stmt=$db->prepare('INSERT INTO password_resets (token_hash,user_serial,expires_at) VALUES (?,?,DATE_ADD(UTC_TIMESTAMP(),INTERVAL 30 MINUTE))'); + $stmt->execute([$hash,$user['user_serial']]);$db->commit(); + }catch(Throwable $e){if($db->inTransaction())$db->rollBack();throw $e;} $url = $baseUrl . '/main.php?Xaction=resetpassword&token=' . rawurlencode($token); if (!$this->deliverResetEmail($user, $url)) { $stmt = $db->prepare('DELETE FROM password_resets WHERE token_hash = :hash'); $stmt->execute([':hash' => $hash]); throw new RuntimeException('Password reset email delivery failed.'); } + Audit::record($db,(int)$user['user_serial'],'requested password reset'); + return true; } protected function deliverResetEmail(array $user, string $url): bool { @@ -174,7 +187,9 @@ class AuthService extends Base { return false; } $this->storePassword($db, (int) $id, $password); + $stmt=$db->prepare('UPDATE users SET user_email_verified_at=UTC_TIMESTAMP() WHERE user_serial=?');$stmt->execute([$id]); $db->commit(); + Audit::record($db,(int)$id,'reset password'); return true; } catch (Throwable $e) { if ($db->inTransaction()) @@ -199,6 +214,7 @@ class AuthService extends Base { } $this->storePassword($db, $id, $password); $db->commit(); + Audit::record($db,$id,'changed password'); return true; } catch (Throwable $e) { if ($db->inTransaction()) diff --git a/classes/Base.php b/classes/Base.php index 3f68928..de16df4 100644 --- a/classes/Base.php +++ b/classes/Base.php @@ -13,7 +13,7 @@ class Base { // Constants // ========= - const APPLICATION_NAME = "Hunting Club Roster"; + const APPLICATION_NAME = "My Hunting Club Roster"; const APPLICATION_MNEMONIC = "HUNTINGCLUBROSTER"; const VERSION = "1.00"; const TIMEZONE = "America/New_York"; @@ -136,11 +136,16 @@ class Base { $dsn = sprintf('mysql:host=%s;port=%d;dbname=%s;charset=utf8mb4', $host, (int) ($settings->DatabasePort ?? 3306), $database); - return new PDO($dsn, $username, $password, - [PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION, + $options=[PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION, PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC, PDO::ATTR_EMULATE_PREPARES => false, - PDO::ATTR_PERSISTENT => false,]); + PDO::ATTR_PERSISTENT => false,]; + $ca=getenv('HCR_DB_TLS_CA')?:''; + if((string)$settings->Environment==='Production'&&!in_array(strtolower($host),['localhost','127.0.0.1','::1'],true)&&!$ca)throw new RuntimeException('Remote production database connections require HCR_DB_TLS_CA and verified TLS.'); + if($ca){if(!is_readable($ca))throw new RuntimeException('The database TLS CA file is not readable.');$options[PDO::MYSQL_ATTR_SSL_CA]=$ca;$options[PDO::MYSQL_ATTR_SSL_VERIFY_SERVER_CERT]=true;} + $db=new PDO($dsn,$username,$password,$options); + if($ca){$cipher=$db->query("SHOW SESSION STATUS LIKE 'Ssl_cipher'")->fetch();if(!$cipher||empty($cipher['Value']))throw new RuntimeException('The database connection did not negotiate TLS.');} + return $db; } catch (PDOException $e) { error_log("Database Connection Failed: " . $e->getMessage()); @@ -216,9 +221,7 @@ class Base { // ===================== public function displayHome() { - - $content = $this->applyXSL("", $this->getXSL("home")); - $this->displayContent($content); + (new Roster())->home(); } // ======================= @@ -250,6 +253,7 @@ class Base { } } $action = strtolower(trim($_POST['action'] ?? $_GET['Xaction'] ?? $_GET['action'] ?? '')); + if($action==='verifyemail'){(new EmailVerification())->page();return;} if ($action === 'signout') { if ($method !== 'POST') { http_response_code(405); @@ -275,9 +279,9 @@ class Base { if (in_array($action, ['signin', 'signin.login', 'users.login'], true)) { (new SignIn())->login(); } - + $user = (new AuthService())->currentUser(); - + if (!$user) { $ajax = $_SESSION[self::AJAX]; if (!empty($_SESSION[self::USER_AUTHENTICATED])) { @@ -296,6 +300,7 @@ class Base { (new Users())->changePassword(); return; } + // Only named, reviewed entry points are routable. Helpers are never endpoints. $routes = [ '' => [Base::class, 'displayHome', false], @@ -306,24 +311,31 @@ class Base { 'validatedate' => [Base::class, 'validateDate', false], 'getage' => [Base::class, 'getAge', false], 'users.changepassword' => [Users::class, 'changePassword', false], - 'print' => [Base::class, 'print', true], - 'print_all_permitsbybuilder.print' => ['Print_All_PermitsByBuilder', 'print', true], - 'export_allpermitsbybuildercsv.export' => ['Export_AllPermitsByBuilderCSV', 'export', true], - 'export_allpermitsbybuilderexcel.export' => ['Export_AllPermitsByBuilderExcel', 'export', true], + 'roster.workspace' => [Roster::class,'workspace',false], + 'roster.help' => [Roster::class,'help',false], + 'rosterreports.ledger' => [RosterReports::class,'ledger',true], + 'rosterreports.csv' => [RosterReports::class,'csv',true], + 'rosterreports.excel' => [RosterReports::class,'excel',true], + 'rosterreports.pdf' => [RosterReports::class,'pdf',true], + + + + ]; $adminRoutes = [ - 'Users' => ['setupUsers', 'addUser', 'editUser', 'deleteUser', 'resetPassword', 'userExists', 'getUser_AJAX', 'updateActiveStatus', 'userActive'], + 'Users' => ['setupUsers', 'userSummary', 'addUser', 'editUser', 'deleteUser', 'resetPassword', 'userExists', 'getUser_AJAX', 'updateActiveStatus', 'userActive'], 'Alerts' => ['setupAlerts', 'addAlert', 'editAlert', 'deleteAlert'], 'Dropdowns' => ['setupDropdowns', 'setupDropdowntypes', 'addDropdown', 'editDropdown', 'deleteDropdown', 'addDropdowntype', 'editDropdowntype', 'deleteDropdowntype', 'dropdownExists', 'dropdowntypeExists', 'dropdowntypetitleExists', 'dropdownActive', 'dropdowntypeActive', 'updateDropdownActive', 'updateDropdownDefault'], 'Popovers' => ['setupPopovers', 'addPopover', 'editPopover', 'deletePopover', 'popoverExists'], - 'Reports' => ['setupReports', 'addReport', 'editReport', 'deleteReport', 'selectReport', 'reportExists'], + 'Reports' => ['setupReports', 'selectReport'], 'Statuses' => ['setupStatuses', 'addStatus', 'editStatus', 'deleteStatus', 'statusExists', 'statusActive'], - 'Journal' => ['viewJournal', 'clearJournal'], - 'Notes' => ['addNote', 'editNote', 'deleteNote', 'addNoteQuick'], + 'Journal' => ['viewJournal'], + 'Notes' => ['addNote', 'editNote', 'deleteNote'], ]; foreach ($adminRoutes as $class => $methods) { - foreach ($methods as $entry) + foreach ($methods as $entry) { $routes[strtolower($class . '.' . $entry)] = [$class, $entry, true]; + } } if (!isset($routes[$action])) { http_response_code(404); @@ -334,11 +346,15 @@ class Base { http_response_code(403); exit('You do not have permission to perform this action.'); } - if ($method !== 'POST' && !in_array($action, ['', './', 'displayhome', 'users.changepassword'], true)) { + if ($method !== 'POST' && !in_array($action, ['', './', 'displayhome', 'users.changepassword','roster.workspace','roster.help'], true)) { http_response_code(405); exit('Use POST for this action.'); } - (new $class())->$entry(); + ob_start(); + try{(new $class())->$entry();$body=ob_get_clean();} + catch(Throwable $e){ob_end_clean();throw $e;} + if($_SESSION[self::AJAX]??false){header('Content-Type: application/json');echo trim($body)===''?json_encode(['ok'=>true]):$body;} + else echo $body; } public function csrfToken(): string { @@ -420,7 +436,7 @@ class Base { public function getSettings() { - $path = getenv('HCR_SETTINGS_FILE') ?: (is_file(__DIR__ . '/../xml/settings.local.xml') ? __DIR__ . '/../xml/settings.local.xml' : __DIR__ . '/../xml/settings.xml'); + $path = getenv('HCR_SETTINGS_FILE') ?: (getenv('HCR_ENVIRONMENT')!=='Production' && is_file(__DIR__ . '/../xml/settings.local.xml') ? __DIR__ . '/../xml/settings.local.xml' : __DIR__ . '/../xml/settings.xml'); $settings = simplexml_load_file($path, SimpleXMLElement::class, LIBXML_NONET); if (!$settings) throw new RuntimeException('Unable to load application settings.'); @@ -673,12 +689,8 @@ class Base { // ============ public function logError($error_message = "") { - - (new Journal())->journalEntry($error_message); - - $this->displayHome(); - - exit(); + error_log($error_message); + throw new AppException('The requested record is invalid or unavailable.',404); } // ========================== @@ -725,20 +737,6 @@ class Base { // Print a Report // ============== - public function print() { - - $_SESSION[self::REPORTS_GET] = $_GET; - $_SESSION[self::REPORTS_POST] = $_POST; - - $report = filter_input(INPUT_POST, "report") ?: ""; - - if ($report !== 'Print_All_PermitsByBuilder') { - http_response_code(404); - exit('Report not found.'); - } - (new $report())->print(); - } - // ================= // Sanitize a string // ================= diff --git a/classes/Dropdowns.php b/classes/Dropdowns.php index f46dbda..eeaa053 100644 --- a/classes/Dropdowns.php +++ b/classes/Dropdowns.php @@ -28,7 +28,7 @@ class Dropdowns extends Base { $this->current_user_name = $_SESSION[self::USER_NAME] ?? ""; $this->current_user_email = $_SESSION[self::USER_EMAIL] ?? ""; - $this->pagination_page = $_SESSION[self::PAGINATION_PAGE] ?? 1; + $this->pagination_page = 1; } // ============ @@ -63,6 +63,7 @@ class Dropdowns extends Base { $dropdowntype_serial = filter_input(INPUT_POST, "dropdowntype_serial", FILTER_SANITIZE_NUMBER_INT) ?: 0; $dropdown_value = filter_input(INPUT_POST, "dropdown_value") ?: ""; + $dropdown_value=trim($dropdown_value);if(!$dropdown_value||strlen($dropdown_value)>100)throw new AppException('Enter a dropdown value up to 100 bytes.'); $SQL = "insert into dropdowns @@ -117,6 +118,8 @@ class Dropdowns extends Base { $dropdowntype_title = filter_input(INPUT_POST, "dropdowntype_title") ?: ""; $dropdowntype_table = filter_input(INPUT_POST, "dropdowntype_table") ?: ""; $dropdowntype_column = filter_input(INPUT_POST, "dropdowntype_column") ?: ""; + MaintenanceService::usageRule($dropdowntype_table, $dropdowntype_column); + if(!trim($dropdowntype_name)||!trim($dropdowntype_title)||strlen($dropdowntype_name)>100||strlen($dropdowntype_title)>100)throw new AppException('Enter a dropdown type name and title up to 100 bytes.'); $SQL = "insert into dropdowntypes @@ -158,19 +161,7 @@ class Dropdowns extends Base { // =============== public function deleteDropdown() { - - $dropdown_serial = filter_input(INPUT_POST, "dropdown_serial", FILTER_SANITIZE_NUMBER_INT) ?: 0; - - $dropdown = $this->getDropdown($dropdown_serial); - - if ($dropdown->count() == 0) { - $this->logError("Invalid Dropdown ({$dropdown_serial}). " . __METHOD__); - } - - $SQL = "delete from dropdowns - where dropdown_serial = {$dropdown_serial}"; - - $this->executeSQL($SQL); + (new MaintenanceService())->deleteDropdown(MaintenanceService::id($_POST['dropdown_serial']??null)); } // =================== @@ -178,19 +169,7 @@ class Dropdowns extends Base { // =================== public function deleteDropdowntype() { - - $dropdowntype_serial = filter_input(INPUT_POST, "dropdowntype_serial", FILTER_SANITIZE_NUMBER_INT) ?: 0; - - $dropdowntype = $this->getDropdowntype($dropdowntype_serial); - - if ($dropdowntype->count() == 0) { - $this->logError("Invalid Dropdowntype ({$dropdowntype_serial}). " . __METHOD__); - } - - $SQL = "delete from dropdowntypes - where dropdowntype_serial = {$dropdowntype_serial}"; - - $this->executeSQL($SQL); + (new MaintenanceService())->deleteType(MaintenanceService::id($_POST['dropdowntype_serial']??null)); } // ============================== @@ -202,6 +181,7 @@ class Dropdowns extends Base { $dropdowntype_serial = filter_input(INPUT_POST, "dropdowntype_serial", FILTER_SANITIZE_NUMBER_INT) ?: 0; $dropdown_serial = filter_input(INPUT_POST, "dropdown_serial", FILTER_SANITIZE_NUMBER_INT) ?: 0; $dropdown_value = filter_input(INPUT_POST, "dropdown_value") ?: ""; + $dropdown_value=trim($dropdown_value);if(!$dropdown_value||strlen($dropdown_value)>100)throw new AppException('Enter a dropdown value up to 100 bytes.'); $dropdown_value = strtolower($dropdown_value); @@ -291,48 +271,8 @@ class Dropdowns extends Base { // ================================= public function dropdownActive() { - - $dropdown_serial = filter_input(INPUT_POST, "dropdown_serial", FILTER_SANITIZE_NUMBER_INT) ?: 0; - - $dropdown = $this->getDropdown($dropdown_serial); - - if ($dropdown->count() == 0) { - $this->logError("Invalid Dropdown ({$dropdown_serial}). " . __METHOD__); - } - - $table = (string) $dropdown->record->dropdowntype_table; - $column = (string) $dropdown->record->dropdowntype_column; - - $active = false; - - switch ($table) { - - case "*none": // No table, never Active. - - break; - - case "*function": // Requires it's own function to determine if Active. - - if (method_exists(__CLASS__, $column)) { - $active = $this->$column($dropdown_serial); - } - - break; - - default: // All others, test the Column in the Table. - - $SQL = "select {$column} - from {$table} - where {$column} = {$dropdown_serial}"; - - $results = $this->getTable("results", $SQL); - - $active = ($results->count() > 0) ? true : false; - - break; - } - - echo json_encode($active); + $id=MaintenanceService::id($_POST['dropdown_serial']??null); + echo json_encode((new MaintenanceService())->dropdownUsed($id)); } // ===================================== @@ -386,6 +326,7 @@ class Dropdowns extends Base { $dropdown_serial = filter_input(INPUT_POST, "dropdown_serial", FILTER_SANITIZE_NUMBER_INT) ?: 0; $dropdown_value = filter_input(INPUT_POST, "dropdown_value") ?: ""; + $dropdown_value=trim($dropdown_value);if(!$dropdown_value||strlen($dropdown_value)>100)throw new AppException('Enter a dropdown value up to 100 bytes.'); $dropdown = $this->getDropdown($dropdown_serial); @@ -451,6 +392,8 @@ class Dropdowns extends Base { $dropdowntype_title = filter_input(INPUT_POST, "dropdowntype_title") ?: ""; $dropdowntype_table = filter_input(INPUT_POST, "dropdowntype_table") ?: ""; $dropdowntype_column = filter_input(INPUT_POST, "dropdowntype_column") ?: ""; + MaintenanceService::usageRule($dropdowntype_table, $dropdowntype_column); + if(!trim($dropdowntype_name)||!trim($dropdowntype_title)||strlen($dropdowntype_name)>100||strlen($dropdowntype_title)>100)throw new AppException('Enter a dropdown type name and title up to 100 bytes.'); $dropdowntype = $this->getDropdowntype($dropdowntype_serial); @@ -559,11 +502,11 @@ class Dropdowns extends Base { // Find Criteria $find_dropdowntype = filter_input(INPUT_POST, "find_dropdowntype") ?: ""; - $find_words = $this->sanitizeString($find_dropdowntype); + $find_words = preg_quote(trim($find_dropdowntype)); // Show Per Page - $this->pagination_size = filter_input(INPUT_POST, "users_per_page", FILTER_SANITIZE_NUMBER_INT) ?: $this->pagination_size; + $this->pagination_size = filter_input(INPUT_POST, "dropdowntypes_per_page", FILTER_SANITIZE_NUMBER_INT) ?: $this->pagination_size; // Record Count @@ -593,21 +536,9 @@ class Dropdowns extends Base { $pagination = filter_input(INPUT_POST, "pagination") ?: ""; - switch ($pagination) { - - case "first" : $this->pagination_page = 1; - break; - case "previous" : $this->pagination_page = max(($this->pagination_page - 1), 1); - break; - case "next" : $this->pagination_page = ($this->pagination_page + 1); - break; - case "last" : $this->pagination_page = ($count / $this->pagination_size); - break; - } - - $offset = (($this->pagination_page * $this->pagination_size) - $this->pagination_size); - $start = ($offset + 1); - $end = min($count, (($start + $this->pagination_size) - 1)); + $paging=Pagination::session(__METHOD__,$count,(int)$this->pagination_size,$pagination); + $this->pagination_size=$paging['size'];$this->pagination_page=$paging['page']; + $offset=$paging['offset'];$start=$paging['start'];$end=$paging['end']; // Data @@ -617,6 +548,7 @@ class Dropdowns extends Base { or dropdowntype_title regexp :dropdowntype_title or dropdowntype_table regexp :dropdowntype_table or dropdowntype_column regexp :dropdowntype_column) + order by dropdowntype_name,dropdowntype_serial limit {$this->pagination_size} offset {$offset}"; @@ -638,7 +570,6 @@ class Dropdowns extends Base { $dropdowntypes->addAttribute("end", $end); $dropdowntypes->addAttribute("page", $this->pagination_page); - $_SESSION[self::PAGINATION_PAGE] = $this->pagination_page; return $dropdowntypes; } @@ -682,24 +613,7 @@ class Dropdowns extends Base { // ====================== public function updateDropdownActive() { - - $dropdown_serial = filter_input(INPUT_POST, "dropdown_serial", FILTER_SANITIZE_NUMBER_INT) ?: 0; - $dropdown_checked = filter_input(INPUT_POST, "dropdown_checked", FILTER_VALIDATE_BOOLEAN) ?: false; - - $SQL = "update dropdowns - set dropdown_active = :dropdown_active, - dropdown_changer = :dropdown_changer, - dropdown_changed = :dropdown_changed - where dropdown_serial = :dropdown_serial"; - - $statement = $this->connect()->prepare($SQL); - - $statement->bindValue(":dropdown_serial", $dropdown_serial); - $statement->bindValue(":dropdown_active", $dropdown_checked, PDO::PARAM_BOOL); - $statement->bindValue(":dropdown_changer", $this->current_user_name); - $statement->bindValue(":dropdown_changed", $this->getTimestamp()); - - $statement->execute(); + (new MaintenanceService())->setDropdownActive(MaintenanceService::id($_POST['dropdown_serial']??null),MaintenanceService::boolean($_POST['dropdown_checked']??null)); } // ======================= @@ -707,26 +621,7 @@ class Dropdowns extends Base { // ======================= public function updateDropdownDefault() { - - $dropdown_serial = filter_input(INPUT_POST, "dropdown_serial", FILTER_SANITIZE_NUMBER_INT) ?: 0; - $dropdown_dropdowntype = filter_input(INPUT_POST, "dropdown_dropdowntype", FILTER_SANITIZE_NUMBER_INT) ?: 0; - $dropdown_checked = filter_input(INPUT_POST, "dropdown_checked") ?: "false"; - - // Unset the Default for the Dropdown Type. - - $SQL = "update dropdowns - set dropdown_default = false - where dropdown_dropdowntype = {$dropdown_dropdowntype}"; - - $this->executeSQL($SQL); - - // Set the Default for the clicked Dropdown. - - $SQL = "update dropdowns - set dropdown_default = {$dropdown_checked} - where dropdown_serial = {$dropdown_serial}"; - - $this->executeSQL($SQL); + (new MaintenanceService())->setDropdownDefault(MaintenanceService::id($_POST['dropdown_serial']??null),MaintenanceService::id($_POST['dropdown_dropdowntype']??null),MaintenanceService::boolean($_POST['dropdown_checked']??null)); } } diff --git a/classes/EmailVerification.php b/classes/EmailVerification.php new file mode 100644 index 0000000..376960e --- /dev/null +++ b/classes/EmailVerification.php @@ -0,0 +1,114 @@ +allowAttempt('verify-ip', $_SERVER['REMOTE_ADDR'] ?? '', 10, 3600) || !$auth->allowAttempt('verify-account', $identifier, 3, 3600)) + return false; + $user = $auth->findUser($identifier); + if (!$user || $user['user_status'] !== 'active' || $user['user_email_verified_at']) + return false; + $url = rtrim((string) $this->getSettings()->ApplicationUrl, '/'); + if (!filter_var($url, FILTER_VALIDATE_URL) || parse_url($url, PHP_URL_SCHEME) !== 'https' || parse_url($url, PHP_URL_QUERY) !== null || parse_url($url, PHP_URL_FRAGMENT) !== null || parse_url($url, PHP_URL_USER) !== null || parse_url($url, PHP_URL_PASS) !== null) + throw new RuntimeException('Configure a trusted HTTPS application URL.'); + $token = bin2hex(random_bytes(32)); + $db = $this->connect(); + $db->beginTransaction(); + try { + $stmt = $db->prepare('SELECT * FROM users WHERE user_serial=? FOR UPDATE'); + $stmt->execute([$user['user_serial']]); + $current = $stmt->fetch(); + if (!$current || $current['user_status'] !== 'active' || $current['user_email_verified_at'] || $current['user_email'] !== $user['user_email'] || (int) $current['user_auth_version'] !== (int) $user['user_auth_version']) { + $db->rollBack(); + return false; + } + $stmt = $db->prepare('INSERT INTO email_verifications(token_hash,user_serial,email,auth_version,expires_at) VALUES(?,?,?,?,DATE_ADD(UTC_TIMESTAMP(),INTERVAL 24 HOUR))'); + $stmt->execute([hash('sha256', $token), $user['user_serial'], $user['user_email'], $user['user_auth_version']]); + $db->commit(); + } catch (Throwable $e) { + if ($db->inTransaction()) + $db->rollBack();throw $e; + } + if (!$this->deliver($user, $url . '/main.php?Xaction=verifyemail&token=' . $token)) { + $stmt = $db->prepare('DELETE FROM email_verifications WHERE token_hash=?'); + $stmt->execute([hash('sha256', $token)]); + throw new RuntimeException('Verification email could not be delivered.'); + } + return true; + } + + protected function deliver(array $user, string $url): bool { + $h = static fn($v) => htmlspecialchars((string) $v, ENT_QUOTES, 'UTF-8'); + return (new Email())->sendEmail($user['user_email'], self::APPLICATION_NAME . ' - Verify your email', '

Verify the email address for account ' . $h($user['user_name']) . '.

Verify email

The link expires in 24 hours. You must also enter the account password. If you did not create this account, ignore this message or use password reset to secure it.

'); + } + + public function confirm(string $token, string $password): bool { + if (!preg_match('/\A[a-f0-9]{64}\z/', $token)) + return false; + $db = $this->connect(); + $db->beginTransaction(); + try { + $stmt = $db->prepare('SELECT user_serial FROM email_verifications WHERE token_hash=?'); + $stmt->execute([hash('sha256', $token)]); + $id = $stmt->fetchColumn(); + if (!$id) { + $db->rollBack(); + return false; + } + $stmt = $db->prepare('SELECT * FROM users WHERE user_serial=? FOR UPDATE'); + $stmt->execute([$id]); + $user = $stmt->fetch(); + $stmt = $db->prepare('SELECT * FROM email_verifications WHERE token_hash=? AND expires_at>UTC_TIMESTAMP() FOR UPDATE'); + $stmt->execute([hash('sha256', $token)]); + $row = $stmt->fetch(); + if (!$row || !$user || $user['user_status'] !== 'active' || $row['email'] !== $user['user_email'] || (int) $row['auth_version'] !== (int) $user['user_auth_version'] || !password_verify($password, $user['user_password_hash'])) { + $db->rollBack(); + return false; + } + $stmt = $db->prepare('UPDATE users SET user_email_verified_at=UTC_TIMESTAMP() WHERE user_serial=?'); + $stmt->execute([$id]); + $stmt = $db->prepare('DELETE FROM email_verifications WHERE user_serial=?'); + $stmt->execute([$id]); + Audit::required($db, (int) $id, 'verified email ownership'); + $db->commit(); + return true; + } catch (Throwable $e) { + if ($db->inTransaction()) + $db->rollBack();throw $e; + } + } + + public function page(): void { + $token = $_POST['token'] ?? $_GET['token'] ?? ''; + $message = ''; + $complete = false; + if (($_SERVER['REQUEST_METHOD'] ?? 'GET') === 'POST') { + $this->requireCsrf(); + if (($_POST['step'] ?? '') === 'confirm') { + $allowed = (new AuthService())->allowAttempt('verify-submit-ip', $_SERVER['REMOTE_ADDR'] ?? '', 20, 900); + $complete = $allowed && $this->confirm($token, $_POST['user_password'] ?? ''); + $message = $complete ? 'Email verified. You can now be assigned to a club.' : 'Unable to verify. Check the password or request a fresh link. You can also reset your password to prove mailbox ownership.'; + } else { + try { + $this->request(trim($_POST['user_email'] ?? '')); + } catch (Throwable $e) { + error_log('Email verification failed: ' . $e->getMessage()); + } + $message = 'If an active account needs verification, a link will be sent. You can also reset your password to verify its email.'; + } + } + $h = static fn($v) => htmlspecialchars((string) $v, ENT_QUOTES, 'UTF-8'); + echo 'Verify email

Verify your email

' . $h($message) . '

'; + if (!$complete) { + echo '
'; + if ($token) + echo ''; + else + echo ''; + echo '
'; + } + echo '

Return to application · Request another link · Reset password

'; + exit; + } +} diff --git a/classes/Journal.php b/classes/Journal.php index 62ccc18..7b29b4f 100644 --- a/classes/Journal.php +++ b/classes/Journal.php @@ -27,7 +27,7 @@ class Journal extends Base { $this->current_user_name = $_SESSION[self::USER_NAME] ?? ""; $this->current_user_email = $_SESSION[self::USER_EMAIL] ?? ""; - $this->pagination_page = $_SESSION[self::PAGINATION_PAGE] ?? 1; + $this->pagination_page = 1; } @@ -37,12 +37,8 @@ class Journal extends Base { public function clearJournal() { - $SQL = "truncate journal"; - - $this->executeSQL($SQL); - - $this->journalEntry("Journal was Cleared."); - + throw new AppException('Audit history cannot be cleared through the application.',403); + } // ======================= @@ -70,7 +66,7 @@ class Journal extends Base { // Find Criteria $find_journal = filter_input(INPUT_POST, "find_journal") ?: ""; - $find_words = $this->sanitizeString($find_journal); + $find_words = preg_quote(trim($find_journal)); // Show Per Page @@ -103,19 +99,10 @@ class Journal extends Base { // Pagination $pagination = filter_input(INPUT_POST, "pagination") ?: ""; - - switch ($pagination) { - - case "first" : $this->pagination_page = 1; break; - case "previous" : $this->pagination_page = max(($this->pagination_page - 1), 1); break; - case "next" : $this->pagination_page = ($this->pagination_page + 1); break; - case "last" : $this->pagination_page = ($count / $this->pagination_size); break; - - } - - $offset = (($this->pagination_page * $this->pagination_size) - $this->pagination_size); - $start = ($offset + 1); - $end = min($count, (($start + $this->pagination_size) - 1)); + + $paging=Pagination::session(__METHOD__,$count,(int)$this->pagination_size,$pagination); + $this->pagination_size=$paging['size'];$this->pagination_page=$paging['page']; + $offset=$paging['offset'];$start=$paging['start'];$end=$paging['end']; // Data @@ -125,6 +112,7 @@ class Journal extends Base { or journal_origin regexp :journal_origin or journal_ip regexp :journal_ip or journal_entry regexp :journal_entry + order by journal_timestamp DESC,journal_serial DESC limit {$this->pagination_size} offset {$offset}"; @@ -145,8 +133,7 @@ class Journal extends Base { $journal->addAttribute("start", $start); $journal->addAttribute("end", $end); $journal->addAttribute("page", $this->pagination_page); - - $_SESSION[self::PAGINATION_PAGE] = $this->pagination_page; + return $journal; diff --git a/classes/LedgerService.php b/classes/LedgerService.php new file mode 100644 index 0000000..78d7444 --- /dev/null +++ b/classes/LedgerService.php @@ -0,0 +1,68 @@ +500)throw new AppException('Enter a correction reason, up to 500 bytes.');return $reason;} + private function transaction(callable $work): void { + $this->requireAdministrator();$db=$this->connect();$db->beginTransaction(); + try{$work($db);$db->commit();}catch(Throwable $e){if($db->inTransaction())$db->rollBack();throw $e;} + } + private function lockedDue(PDO $db,int $club,int $due): array { + $this->club($club,$db,true); + $stmt=$db->prepare('SELECT * FROM club_dues WHERE due_serial=? AND club_serial=? FOR UPDATE');$stmt->execute([$due,$club]);$row=$stmt->fetch(); + if(!$row)throw new AppException('Dues record not found in this club.',404); + $stmt=$db->prepare('SELECT COALESCE(SUM(amount_cents),0) FROM club_due_adjustments WHERE due_serial=?');$stmt->execute([$due]);$row['effective']=(int)$row['amount_cents']+(int)$stmt->fetchColumn(); + $stmt=$db->prepare('SELECT COALESCE(SUM(p.amount_cents),0) FROM club_payments p WHERE p.due_serial=? AND NOT EXISTS(SELECT 1 FROM club_payment_reversals r WHERE r.payment_serial=p.payment_serial)');$stmt->execute([$due]);$row['paid']=(int)$stmt->fetchColumn();return $row; + } + public function charge(int $club,int $membership,int $season,string $amount): void { + $cents=self::cents($amount); + $this->transaction(function(PDO $db)use($club,$membership,$season,$cents){ + $this->club($club,$db,true); + $stmt=$db->prepare("SELECT membership_serial FROM club_memberships WHERE membership_serial=? AND club_serial=? AND membership_status='active' FOR UPDATE");$stmt->execute([$membership,$club]);if(!$stmt->fetch())throw new AppException('Select an active member of this club.',409); + $stmt=$db->prepare('SELECT season_serial FROM club_seasons WHERE season_serial=? AND club_serial=? FOR UPDATE');$stmt->execute([$season,$club]);if(!$stmt->fetch())throw new AppException('Select a season belonging to this club.',409); + $stmt=$db->prepare('INSERT INTO club_dues(club_serial,membership_serial,season_serial,amount_cents,recorded_by) VALUES(?,?,?,?,?)');$stmt->execute([$club,$membership,$season,$cents,$this->actor()]); + Audit::required($db,$this->actor(),'created dues '.json_encode(['due'=>(int)$db->lastInsertId(),'club'=>$club,'membership'=>$membership,'season'=>$season,'amount_cents'=>$cents])); + }); + } + public function payment(int $club,int $due,string $amount,string $paid,string $key,string $method='unspecified',string $reference=''): void { + $cents=self::cents($amount);self::date($paid);$this->key($key);$reference=trim($reference); + if($cents<=0||$paid>date('Y-m-d')||!in_array($method,['unspecified','cash','check','transfer','other'],true)||strlen($reference)>100)throw new AppException('Enter a positive payment, a valid date/method, and a reference up to 100 bytes.'); + $this->transaction(function(PDO $db)use($club,$due,$cents,$paid,$key,$method,$reference){ + $row=$this->lockedDue($db,$club,$due); + $stmt=$db->prepare('SELECT * FROM club_payments WHERE request_key=?');$stmt->execute([$key]);$existing=$stmt->fetch(); + if($existing){if((int)$existing['due_serial']!==$due||(int)$existing['amount_cents']!==$cents||$existing['paid_on']!==$paid||$existing['payment_method']!==$method||$existing['payment_reference']!==$reference)throw new AppException('This request key was already used for different payment details.',409);return;} + if($cents>$row['effective']-$row['paid'])throw new AppException('Payment exceeds the outstanding balance.',409); + $stmt=$db->prepare('INSERT INTO club_payments(due_serial,amount_cents,paid_on,request_key,recorded_by,payment_method,payment_reference) VALUES(?,?,?,?,?,?,?)');$stmt->execute([$due,$cents,$paid,$key,$this->actor(),$method,$reference]); + Audit::required($db,$this->actor(),'received payment '.json_encode(['payment'=>(int)$db->lastInsertId(),'club'=>$club,'due'=>$due,'amount_cents'=>$cents,'paid_on'=>$paid,'method'=>$method,'reference'=>$reference])); + }); + } + public function adjust(int $club,int $due,string $total,string $reason,string $key): void { + $cents=self::cents($total);$reason=$this->reason($reason);$this->key($key); + $this->transaction(function(PDO $db)use($club,$due,$cents,$reason,$key){ + $row=$this->lockedDue($db,$club,$due);$stmt=$db->prepare('SELECT * FROM club_due_adjustments WHERE request_key=?');$stmt->execute([$key]);$existing=$stmt->fetch(); + if($existing){if((int)$existing['due_serial']!==$due||(int)$existing['corrected_amount_cents']!==$cents||$existing['reason']!==$reason)throw new AppException('This request key was already used for different correction details.',409);return;} + if($cents<$row['paid'])throw new AppException('Corrected dues cannot be below received payments. Reverse an incorrect payment first.',409); + if($cents===$row['effective'])throw new AppException('The corrected amount must differ from the current dues.',409); + $stmt=$db->prepare('INSERT INTO club_due_adjustments(due_serial,amount_cents,corrected_amount_cents,reason,recorded_by,request_key) VALUES(?,?,?,?,?,?)');$stmt->execute([$due,$cents-$row['effective'],$cents,$reason,$this->actor(),$key]); + Audit::required($db,$this->actor(),'corrected dues '.json_encode(['adjustment'=>(int)$db->lastInsertId(),'club'=>$club,'due'=>$due,'before_cents'=>$row['effective'],'after_cents'=>$cents,'reason'=>$reason])); + }); + } + public function reverse(int $club,int $payment,string $reason,string $key): void { + $reason=$this->reason($reason);$this->key($key); + $this->transaction(function(PDO $db)use($club,$payment,$reason,$key){ + $this->club($club,$db,true);$stmt=$db->prepare('SELECT p.* FROM club_payments p JOIN club_dues d ON d.due_serial=p.due_serial WHERE p.payment_serial=? AND d.club_serial=?');$stmt->execute([$payment,$club]);$row=$stmt->fetch();if(!$row)throw new AppException('Payment not found in this club.',404); + $this->lockedDue($db,$club,(int)$row['due_serial']); + $stmt=$db->prepare('SELECT * FROM club_payment_reversals WHERE request_key=? OR payment_serial=?');$stmt->execute([$key,$payment]);$existing=$stmt->fetch(); + if($existing){if($existing['request_key']===$key&&(int)$existing['payment_serial']===$payment&&$existing['reason']===$reason)return;throw new AppException('Payment is already reversed or this request key was already used.',409);} + $stmt=$db->prepare('INSERT INTO club_payment_reversals(payment_serial,reason,recorded_by,request_key) VALUES(?,?,?,?)');$stmt->execute([$payment,$reason,$this->actor(),$key]); + Audit::required($db,$this->actor(),'reversed payment '.json_encode(['reversal'=>(int)$db->lastInsertId(),'club'=>$club,'payment'=>$payment,'amount_cents'=>(int)$row['amount_cents'],'reason'=>$reason])); + }); + } + public function history(int $club): array { + $this->club($club);$result=[];$db=$this->connect(); + $scope=$this->administrator()?'':' AND m.user_serial=?';$args=$this->administrator()?[$club]:[$club,$_SESSION[self::USER_SERIAL]??0]; + $stmt=$db->prepare('SELECT p.*,m.user_serial,r.reversal_serial,r.reason AS reversal_reason,r.created_at AS reversed_at,CONCAT_WS(" ",u.user_first_name,u.user_last_name) AS member_name,a.user_name AS actor,ra.user_name AS reversal_actor FROM club_payments p JOIN club_dues d ON d.due_serial=p.due_serial JOIN club_memberships m ON m.membership_serial=d.membership_serial JOIN users u ON u.user_serial=m.user_serial LEFT JOIN club_payment_reversals r ON r.payment_serial=p.payment_serial LEFT JOIN users a ON a.user_serial=p.recorded_by LEFT JOIN users ra ON ra.user_serial=r.recorded_by WHERE d.club_serial=?'.$scope.' ORDER BY p.paid_on DESC,p.payment_serial DESC');$stmt->execute($args);$result['payments']=$stmt->fetchAll(); + $stmt=$db->prepare('SELECT x.*,CONCAT_WS(" ",u.user_first_name,u.user_last_name) AS member_name,a.user_name AS actor FROM club_due_adjustments x JOIN club_dues d ON d.due_serial=x.due_serial JOIN club_memberships m ON m.membership_serial=d.membership_serial JOIN users u ON u.user_serial=m.user_serial JOIN users a ON a.user_serial=x.recorded_by WHERE d.club_serial=?'.$scope.' ORDER BY x.adjustment_serial DESC');$stmt->execute($args);$result['adjustments']=$stmt->fetchAll();return $result; + } +} diff --git a/classes/MaintenanceService.php b/classes/MaintenanceService.php new file mode 100644 index 0000000..1cd0171 --- /dev/null +++ b/classes/MaintenanceService.php @@ -0,0 +1,310 @@ + ['min_range' => 1]]); + if ($id === false) + throw new AppException('A valid record ID is required.'); + return $id; + } + + public static function boolean(mixed $value): bool { + if (!is_scalar($value)) + throw new AppException('A true or false value is required.'); + $result = filter_var($value, FILTER_VALIDATE_BOOLEAN, FILTER_NULL_ON_FAILURE); + if (!is_scalar($value) || $result === null || $value === '') + throw new AppException('A true or false value is required.'); + return $result; + } + + public static function usageRule(string $table, string $column): void { + // No current roster field uses dropdown IDs. Add explicit code-owned references + // here when such a feature is implemented; database values are never SQL/callbacks. + if ($table !== '*none' || $column !== '') { + throw new AppException('Only "No usage reference" is supported. Custom table names and callbacks are disabled.'); + } + } + + public function dropdownUsed(int $id, ?PDO $db = null): bool { + $stmt = ($db ?? $this->connect())->prepare('SELECT d.dropdown_default,t.dropdowntype_table, t.dropdowntype_column FROM dropdowns d JOIN dropdowntypes t ON t.dropdowntype_serial=d.dropdown_dropdowntype WHERE d.dropdown_serial=?'); + $stmt->execute([$id]); + $row = $stmt->fetch(); + if (!$row) + throw new AppException('Dropdown not found.', 404); + self::usageRule((string) $row['dropdowntype_table'], (string) $row['dropdowntype_column']); + return (bool) $row['dropdown_default']; + } + + public function deleteDropdown(int $id): void { + $db = $this->connect(); + $db->beginTransaction(); + try { + $stmt = $db->prepare('SELECT dropdown_dropdowntype FROM dropdowns WHERE dropdown_serial=?'); + $stmt->execute([$id]); + $type = $stmt->fetchColumn(); + if (!$type) + throw new AppException('Dropdown not found.', 404); + $stmt = $db->prepare('SELECT dropdowntype_serial FROM dropdowntypes WHERE dropdowntype_serial=? FOR UPDATE'); + $stmt->execute([$type]); + $stmt->fetch(); + $stmt = $db->prepare('SELECT dropdown_default FROM dropdowns WHERE dropdown_serial=? FOR UPDATE'); + $stmt->execute([$id]); + $row = $stmt->fetch(); + if (!$row) + throw new AppException('Dropdown not found.', 404); + if ($row['dropdown_default'] || $this->dropdownUsed($id, $db)) + throw new AppException('Choose another default before deleting this dropdown.', 409); + $stmt = $db->prepare('DELETE FROM dropdowns WHERE dropdown_serial=?'); + $stmt->execute([$id]); + $db->commit(); + } catch (Throwable $e) { + if ($db->inTransaction()) + $db->rollBack();throw $e; + } + } + + public function deleteType(int $id): void { + $db = $this->connect(); + $db->beginTransaction(); + try { + $stmt = $db->prepare('SELECT dropdowntype_serial FROM dropdowntypes WHERE dropdowntype_serial=? FOR UPDATE'); + $stmt->execute([$id]); + if (!$stmt->fetch()) + throw new AppException('Dropdown type not found.', 404); + $stmt = $db->prepare('SELECT dropdown_serial FROM dropdowns WHERE dropdown_dropdowntype=? LIMIT 1'); + $stmt->execute([$id]); + if ($stmt->fetch()) + throw new AppException('Remove the dropdown values before deleting their type.', 409); + $stmt = $db->prepare('DELETE FROM dropdowntypes WHERE dropdowntype_serial=?'); + $stmt->execute([$id]); + $db->commit(); + } catch (Throwable $e) { + if ($db->inTransaction()) + $db->rollBack();throw $e; + } + } + + public function setDropdownDefault(int $id, int $type, bool $checked): void { + $db = $this->connect(); + $db->beginTransaction(); + try { + $stmt = $db->prepare('SELECT dropdowntype_serial FROM dropdowntypes WHERE dropdowntype_serial=? FOR UPDATE'); + $stmt->execute([$type]); + if (!$stmt->fetch()) + throw new AppException('Dropdown type not found.', 404); + $stmt = $db->prepare('SELECT dropdown_dropdowntype,dropdown_active FROM dropdowns WHERE dropdown_serial=? FOR UPDATE'); + $stmt->execute([$id]); + $row = $stmt->fetch(); + if (!$row || (int) $row['dropdown_dropdowntype'] !== $type) + throw new AppException('Dropdown does not belong to this type.', 409); + if ($checked && !$row['dropdown_active']) + throw new AppException('Activate the dropdown before selecting it as the default.', 409); + if ($checked) { + $stmt = $db->prepare('UPDATE dropdowns SET dropdown_default=0 WHERE dropdown_dropdowntype=?'); + $stmt->execute([$type]); + } + $stmt = $db->prepare('UPDATE dropdowns SET dropdown_default=?, dropdown_changer=?,dropdown_changed=? WHERE dropdown_serial=?'); + $stmt->execute([(int) $checked, $_SESSION[self::USER_NAME] ?? '', $this->getTimestamp(), $id]); + $db->commit(); + } catch (Throwable $e) { + if ($db->inTransaction()) + $db->rollBack();throw $e; + } + } + + public function setDropdownActive(int $id, bool $checked): void { + $stmt = $this->connect()->prepare('UPDATE dropdowns SET dropdown_active=?,dropdown_default=IF(?=0,0,dropdown_default),dropdown_changer=?,dropdown_changed=? WHERE dropdown_serial=?'); + $stmt->execute([(int) $checked, (int) $checked, $_SESSION[self::USER_NAME] ?? '', $this->getTimestamp(), $id]); + } + + private function lockAdministrators(PDO $db): array { + return $db->query("SELECT user_serial FROM users WHERE user_status='active' AND user_role IN ('Administrator','System Administrator') ORDER BY user_serial FOR UPDATE")->fetchAll(PDO::FETCH_COLUMN); + } + + private function guardAdministrator(array $admins, int $id, string $role, string $status, bool $deleting = false): void { + if ($deleting && $id === (int) ($_SESSION[self::USER_SERIAL] ?? 0)) + throw new AppException('You cannot delete your own account.', 409); + if (in_array($id, array_map('intval', $admins), true) && count($admins) <= 1 && ($deleting || $status !== 'active' || !in_array($role, ['Administrator', 'System Administrator'], true))) { + throw new AppException('The last active administrator cannot be removed, disabled or demoted.', 409); + } + } + + public function userUsed(int $id, ?PDO $db = null): bool { + $db ??= $this->connect(); + $stmt = $db->prepare("SELECT COUNT(*) FROM notes WHERE note_type='User' AND note_reference=?"); + $stmt->execute([$id]); + if ((int) $stmt->fetchColumn() > 0) + return true; + $stmt = $db->prepare('SELECT COUNT(*) FROM journal WHERE journal_origin=?'); + $stmt->execute([(string) $id]); + if ((int) $stmt->fetchColumn() > 0) + return true; + // Roster tables are installed by the separate non-destructive roster migration. + $exists = $db->query("SELECT COUNT(*) FROM information_schema.TABLES WHERE TABLE_SCHEMA=DATABASE() AND TABLE_NAME='club_memberships'")->fetchColumn(); + if ($exists) { + $stmt = $db->prepare('SELECT COUNT(*) FROM club_memberships WHERE user_serial=?'); + $stmt->execute([$id]); + if ((int) $stmt->fetchColumn() > 0) + return true; + } + return false; + } + + public function deleteUser(int $id): void { + $db = $this->connect(); + $db->beginTransaction(); + try { + $admins = $this->lockAdministrators($db); + $stmt = $db->prepare('SELECT user_role,user_status FROM users WHERE user_serial=? FOR UPDATE'); + $stmt->execute([$id]); + $user = $stmt->fetch(); + if (!$user) + throw new AppException('User not found.', 404); + if ($user['user_role'] === 'System Administrator' && ($_SESSION[self::USER_ROLE] ?? '') !== 'System Administrator') + throw new AppException('Only a system administrator can modify that account.', 403); + $this->guardAdministrator($admins, $id, $user['user_role'], $user['user_status'], true); + if ($this->userUsed($id, $db)) + throw new AppException('This user has recorded history. Disable the account to preserve its history.', 409); + $stmt = $db->prepare('DELETE FROM password_resets WHERE user_serial=?'); + $stmt->execute([$id]); + $stmt = $db->prepare('DELETE FROM users WHERE user_serial=?'); + $stmt->execute([$id]); + Audit::required($db, (int) ($_SESSION[self::USER_SERIAL] ?? 0), 'deleted unused user ' . $id); + $db->commit(); + } catch (Throwable $e) { + if ($db->inTransaction()) + $db->rollBack();throw $e; + } + } + + public function updateUser(int $id, array $input): void { + $name = trim($input['user_name'] ?? ''); + $email = trim($input['user_email'] ?? ''); + $first = trim($input['user_first_name'] ?? ''); + $last = trim($input['user_last_name'] ?? ''); + $role = $input['user_role'] ?? ''; + $status = self::boolean($input['user_active'] ?? false) ? 'active' : 'inactive'; + if (!preg_match('/\A[A-Za-z0-9_.-]{3,64}\z/', $name) || !filter_var($email, FILTER_VALIDATE_EMAIL) || strlen($email) > 100 || !$first || !$last || strlen($first) > 128 || strlen($last) > 128 || !in_array($role, ['User', 'Guest', 'Administrator', 'System Administrator'], true)) + throw new AppException('Enter a valid username, first/last name, email and role.'); + // Only an existing system administrator may assign that role. + if ($role === 'System Administrator' && ($_SESSION[self::USER_ROLE] ?? '') !== 'System Administrator') + throw new AppException('Only a system administrator can assign that role.', 403); + $db = $this->connect(); + $db->beginTransaction(); + try { + $admins = $this->lockAdministrators($db); + $stmt = $db->prepare('SELECT * FROM users WHERE user_serial=? FOR UPDATE'); + $stmt->execute([$id]); + $old = $stmt->fetch(); + if (!$old) + throw new AppException('User not found.', 404); + if ($old['user_role'] === 'System Administrator' && ($_SESSION[self::USER_ROLE] ?? '') !== 'System Administrator') + throw new AppException('Only a system administrator can modify that account.', 403); + $this->guardAdministrator($admins, $id, $role, $status); + $revoke = $old['user_role'] !== $role || $old['user_status'] !== $status || $old['user_email'] !== $email || $old['user_name'] !== $name; + $stmt = $db->prepare('UPDATE users SET user_name=?,user_email=?,user_first_name=?,user_last_name=?,user_role=?,user_status=?,user_auth_version=user_auth_version+?,user_changer=?,user_changed=? WHERE user_serial=?'); + $stmt->execute([$name, $email, $first, $last, $role, $status, (int) $revoke, $_SESSION[self::USER_NAME] ?? '', $this->getTimestamp(), $id]); + if ($old['user_email'] !== $email) { + $stmt = $db->prepare('UPDATE users SET user_email_verified_at=NULL WHERE user_serial=?'); + $stmt->execute([$id]); + } + if ($revoke) { + $stmt = $db->prepare('DELETE FROM password_resets WHERE user_serial=?'); + $stmt->execute([$id]); + $stmt = $db->prepare('DELETE FROM email_verifications WHERE user_serial=?'); + $stmt->execute([$id]); + } + $fields = ['user_name', 'user_email', 'user_first_name', 'user_last_name', 'user_role', 'user_status']; + Audit::required($db, (int) ($_SESSION[self::USER_SERIAL] ?? 0), 'updated user ' . json_encode(['user' => $id, 'before' => array_intersect_key($old, array_flip($fields)), 'after' => ['user_name' => $name, 'user_email' => $email, 'user_first_name' => $first, 'user_last_name' => $last, 'user_role' => $role, 'user_status' => $status]])); + $db->commit(); + } catch (Throwable $e) { + if ($db->inTransaction()) + $db->rollBack();throw $e; + } + } + + public function setUserActive(int $id, bool $active): void { + $db = $this->connect(); + $db->beginTransaction(); + try { + $admins = $this->lockAdministrators($db); + $stmt = $db->prepare('SELECT user_role FROM users WHERE user_serial=? FOR UPDATE'); + $stmt->execute([$id]); + $role = $stmt->fetchColumn(); + if (!$role) + throw new AppException('User not found.', 404); + if ($role === 'System Administrator' && ($_SESSION[self::USER_ROLE] ?? '') !== 'System Administrator') + throw new AppException('Only a system administrator can modify that account.', 403); + $this->guardAdministrator($admins, $id, $role, $active ? 'active' : 'inactive'); + $stmt = $db->prepare('UPDATE users SET user_status=?,user_auth_version=user_auth_version+1 WHERE user_serial=?'); + $stmt->execute([$active ? 'active' : 'inactive', $id]); + $stmt = $db->prepare('DELETE FROM password_resets WHERE user_serial=?'); + $stmt->execute([$id]); + $stmt = $db->prepare('DELETE FROM email_verifications WHERE user_serial=?'); + $stmt->execute([$id]); + Audit::required($db, (int) ($_SESSION[self::USER_SERIAL] ?? 0), 'changed user status ' . json_encode(['user' => $id, 'active' => $active])); + $db->commit(); + } catch (Throwable $e) { + if ($db->inTransaction()) + $db->rollBack();throw $e; + } + } + + public function deleteStatus(int $id): void { + $db = $this->connect(); + $db->beginTransaction(); + try { + $rows = $db->query('SELECT status_serial,status_default FROM statuses ORDER BY status_serial FOR UPDATE')->fetchAll(PDO::FETCH_KEY_PAIR); + if (!array_key_exists($id, $rows)) + throw new AppException('Status not found.', 404); + if ($rows[$id]) + throw new AppException('Choose another default before deleting this status.', 409); + // Current club membership statuses are explicit enums, not references to this list. + $stmt = $db->prepare('DELETE FROM statuses WHERE status_serial=?'); + $stmt->execute([$id]); + $db->commit(); + } catch (Throwable $e) { + if ($db->inTransaction()) + $db->rollBack();throw $e; + } + } + + public function saveStatus(int $id, array $input): void { + $name = trim($input['status_name'] ?? ''); + $classes = trim($input['status_classes'] ?? ''); + $active = self::boolean($input['status_active'] ?? false); + $default = self::boolean($input['status_default'] ?? false); + if (!$name || strlen($name) > 100 || strlen($classes) > 100 || !preg_match('/\A[A-Za-z0-9_ -]*\z/', $classes)) + throw new AppException('Enter a status name and valid CSS classes (up to 100 bytes).'); + if ($default && !$active) + throw new AppException('The default status must be active.'); + $db = $this->connect(); + $db->beginTransaction(); + try { + $db->query('SELECT status_serial FROM statuses ORDER BY status_serial FOR UPDATE')->fetchAll(); + $stmt = $db->prepare('SELECT status_serial FROM statuses WHERE LOWER(status_name)=LOWER(?) AND status_serial<>?'); + $stmt->execute([$name, $id]); + if ($stmt->fetch()) + throw new AppException('A status with that name already exists.', 409); + if ($default) + $db->exec('UPDATE statuses SET status_default=0'); + if ($id) { + $stmt = $db->prepare('SELECT status_serial FROM statuses WHERE status_serial=?'); + $stmt->execute([$id]); + if (!$stmt->fetch()) + throw new AppException('Status not found.', 404); + $stmt = $db->prepare('UPDATE statuses SET status_name=?,status_classes=?,status_active=?,status_default=?,status_changer=?,status_changed=? WHERE status_serial=?'); + $stmt->execute([$name, $classes, (int) $active, (int) $default, $_SESSION[self::USER_NAME] ?? '', $this->getTimestamp(), $id]); + } else { + $stmt = $db->prepare('INSERT INTO statuses(status_name,status_classes,status_active,status_default,status_creator,status_created) VALUES(?,?,?,?,?,?)'); + $stmt->execute([$name, $classes, (int) $active, (int) $default, $_SESSION[self::USER_NAME] ?? '', $this->getTimestamp()]); + } + $db->commit(); + } catch (Throwable $e) { + if ($db->inTransaction()) + $db->rollBack();throw $e; + } + } +} diff --git a/classes/Metrics.php b/classes/Metrics.php index 2b78b69..7dbad76 100644 --- a/classes/Metrics.php +++ b/classes/Metrics.php @@ -1,96 +1,5 @@ = (date(now()) - interval 6 day) - group by day - order by workorder_created desc"; - - return $this->getTable("dailymetrics", $SQL); - - } - - // ===================================== - // Return a Monthly Call Metrics Object. - // ===================================== - - private function getMonthlyWorkOrderMetrics() { - - $SQL = "select monthname(workorder_created) as month, - count(*) as count - from view_workorders - where date(workorder_created) >= (date(now()) - interval 6 month) - group by month - order by workorder_created desc"; - - return $this->getTable("monthlymetrics", $SQL); - - } - - // ========================================= - // Return a Weekly Work Order Metrics Object - // ========================================= - - private function getWeeklyWorkOrderMetrics() { - - $SQL = "select week(workorder_created) as week, - count(*) as count - from view_workorders - where date(workorder_created) >= (date(now()) - interval 6 week) - group by week - order by workorder_created desc"; - - return $this->getTable("weeklymetrics", $SQL); - - } - - // ======================= - // View Work Order Metrics - // ======================= - - public function viewWorkOrderMetrics() { - - $dailymetrics = $this->getDailyWorkOrderMetrics(); - $weeklymetrics = $this->getWeeklyWorkOrderMetrics(); - $monthlymetrics = $this->getMonthlyWorkorderMetrics(); - - $XSLParms["DAILYMETRICS"] = $dailymetrics->asXML(); - $XSLParms["WEEKLYMETRICS"] = $weeklymetrics->asXML(); - $XSLParms["MONTHLYMETRICS"] = $monthlymetrics->asXML(); - - $content = $this->applyXSL("", $this->getXSL("viewWorkOrderMetrics"), $XSLParms); - - $this->displayContent($content); - - exit(); - - } - + public function viewRosterMetrics(){(new Roster())->home();} } - -?> diff --git a/classes/Notes.php b/classes/Notes.php index 8eb4dd3..4f5b0f6 100644 --- a/classes/Notes.php +++ b/classes/Notes.php @@ -1,244 +1,35 @@ current_user_name = $_SESSION[self::USER_NAME] ?? ""; - $this->current_user_email = $_SESSION[self::USER_EMAIL] ?? ""; + public const VALID_TYPES=['User']; + public function addNote(){ + if(($_POST['step']??'prompt')==='add'){$this->write(0,$_POST['note_type']??'',MaintenanceService::id($_POST['note_reference']??null),$_POST['note_text']??'');return;} + $type=$_POST['note_type']??'';$id=MaintenanceService::id($_POST['note_reference']??null); + if(!in_array($type,self::VALID_TYPES,true))throw new AppException('Unsupported note type.'); + $stmt=$this->connect()->prepare('SELECT user_serial FROM users WHERE user_serial=?');$stmt->execute([$id]);if(!$stmt->fetch())throw new AppException('User not found.',404); + $this->displayContent($this->applyXSL('',$this->getXSL('addNote'),['NOTE_TYPE'=>$type,'NOTE_REFERENCE'=>$id])); } - - // ======== - // Add Note - // ======== - - public function addNote() { - - $step = filter_input(INPUT_POST, "step") ?: "prompt"; - - switch ($step) { - - case "prompt": - - $note_type = filter_input(INPUT_POST, "note_type") ?: ""; - $note_reference = filter_input(INPUT_POST, "note_reference", FILTER_SANITIZE_NUMBER_INT) ?: 0; - - if (!in_array($note_type, self::VALID_TYPES) or empty($note_reference)) { - $this->logError("Invalid Note Type ({$note_type} or Reference {$note_reference} " . __METHOD__); - } - - $XSLParms["NOTE_TYPE"] = $note_type; - $XSLParms["NOTE_REFERENCE"] = $note_reference; - - $content = $this->applyXSL("", $this->getXSL("addNote"), $XSLParms); - - $this->displayContent($content); - - break; - - case "add": - - $note_type = filter_input(INPUT_POST, "note_type") ?: ""; - $note_reference = filter_input(INPUT_POST, "note_reference", FILTER_SANITIZE_NUMBER_INT) ?: 0; - $note_text = filter_input(INPUT_POST, "note_text") ?: ""; - - $SQL = "insert into notes - - ( note_type, - note_reference, - note_text, - note_origin ) - - VALUES ( :note_type, - :note_reference, - :note_text, - :note_origin )"; - - $statement = $this->connect()->prepare($SQL); - - $statement->bindValue(":note_type", $note_type); - $statement->bindValue(":note_reference", $note_reference); - $statement->bindValue(":note_text", $note_text); - $statement->bindValue(":note_origin", $this->current_user_name); - - $statement->execute(); - - break; - - default: - - $this->displayHome(); - } + public function editNote(){ + $id=MaintenanceService::id($_POST['note_serial']??null);$note=$this->getNote($id); + if(!$note->count())throw new AppException('Note not found.',404); + if(($_POST['step']??'prompt')==='update'){$this->write($id,(string)$note->record->note_type,(int)$note->record->note_reference,$_POST['note_text']??'');return;} + $this->displayContent($this->applyXSL($note,$this->getXSL('editNote'))); } - - // =========== - // Delete Note - // =========== - - public function deleteNote() { - - $note_serial = filter_input(INPUT_POST, "note_serial", FILTER_SANITIZE_NUMBER_INT) ?: 0; - - $note = $this->getNote($note_serial); - - if ($note->count() == 0) { - $this->logError("Invalid Note ({$note_serial}). " . __METHOD__); - } - - $SQL = "delete from notes - where note_serial = {$note_serial}"; - - $this->executeSQL($SQL); + public function deleteNote(){ + $stmt=$this->connect()->prepare('DELETE FROM notes WHERE note_serial=?');$stmt->execute([MaintenanceService::id($_POST['note_serial']??null)]);if(!$stmt->rowCount())throw new AppException('Note not found.',404); } - - // ========= - // Edit Note - // ========= - - public function editNote() { - - $step = filter_input(INPUT_POST, "step") ?: "prompt"; - - switch ($step) { - - case "prompt": - - $note_serial = filter_input(INPUT_POST, "note_serial", FILTER_SANITIZE_NUMBER_INT) ?: 0; - - $note = $this->getNote($note_serial); - - if ($note->count() == 0) { - $this->logError("Invalid Note ({$note_serial}). " . __METHOD__); - } - - $XML = $this->mergeXML($note, ""); - - $content = $this->applyXSL($XML, $this->getXSL("editNote")); - - $this->displayContent($content); - - break; - - case "update": - - $note_serial = filter_input(INPUT_POST, "note_serial", FILTER_SANITIZE_NUMBER_INT) ?: 0; - $note_text = filter_input(INPUT_POST, "note_text") ?: ""; - - $SQL = "update notes - set note_text = :note_text, - note_origin = :note_origin - where note_serial = :note_serial"; - - $statement = $this->connect()->prepare($SQL); - - $statement->bindValue(":note_serial", $note_serial); - $statement->bindValue(":note_text", $note_text); - $statement->bindValue(":note_origin", $this->current_user_name); - - $statement->execute(); - - break; - - default: - - $this->displayHome(); - } - } - - // ==================== - // Return a Note Object - // ==================== - - public function getNote($note_serial = 0) { - - $SQL = "select view_notes.* - from view_notes - where note_serial = {$note_serial}"; - - return $this->getTable("notes", $SQL); - } - - // ===================== - // Return a Notes Object - // ===================== - - public function getNotes($note_type = "", $note_reference = 0) { - - $SQL = "select view_notes.* - from view_notes - where note_type = '{$note_type}' - and note_reference = {$note_reference} - order by note_timestamp asc"; - - return $this->getTable("notes", $SQL); - } - - // ===================== - // Return a Notes Object - // ===================== - - public function getAllNotes($note_reference = 0) { - - $SQL = "select view_notes.* - from view_notes - where note_reference = {$note_reference} - order by note_timestamp asc"; - -// $this->debug($SQL); - - return $this->getTable("notes", $SQL); - } - - // ============== - // Add Note Quick - // ============== - - public function addNoteQuick($note_type = "", $note_reference = 0, $note_text = "") { - - $SQL = "insert into notes - - ( note_type, - note_reference, - note_text, - note_origin ) - - VALUES ( :note_type, - :note_reference, - :note_text, - :note_origin )"; - - $statement = $this->connect()->prepare($SQL); - - $statement->bindValue(":note_type", $note_type); - $statement->bindValue(":note_reference", $note_reference); - $statement->bindValue(":note_text", $note_text); - $statement->bindValue(":note_origin", $this->current_user_name); - - $statement->execute(); + public function write(int $id,string $type,int $reference,string $text): int { + $text=trim($text);if(!in_array($type,self::VALID_TYPES,true)||!$text||strlen($text)>65535)throw new AppException('Enter a valid user note (up to 65,535 bytes).'); + $db=$this->connect();$db->beginTransaction(); + try{ + $stmt=$db->prepare('SELECT user_serial FROM users WHERE user_serial=? FOR UPDATE');$stmt->execute([$reference]);if(!$stmt->fetch())throw new AppException('The note must refer to an existing user.',409); + if($id){$stmt=$db->prepare('SELECT note_serial FROM notes WHERE note_serial=? AND note_type=? AND note_reference=? FOR UPDATE');$stmt->execute([$id,$type,$reference]);if(!$stmt->fetch())throw new AppException('Note not found.',404); + $stmt=$db->prepare('UPDATE notes SET note_text=?,note_origin=? WHERE note_serial=?');$stmt->execute([$text,$_SESSION[self::USER_NAME]??'',$id]); + }else{$stmt=$db->prepare('INSERT INTO notes(note_type,note_reference,note_text,note_origin) VALUES(?,?,?,?)');$stmt->execute([$type,$reference,$text,$_SESSION[self::USER_NAME]??'']);$id=(int)$db->lastInsertId();} + $db->commit();return $id; + }catch(Throwable $e){if($db->inTransaction())$db->rollBack();throw $e;} } + public function getNote($id=0){$stmt=$this->connect()->prepare('SELECT * FROM view_notes WHERE note_serial=?');$stmt->execute([(int)$id]);return $this->getTableXML('notes',$stmt);} + public function getNotes($type='',$reference=0){$stmt=$this->connect()->prepare('SELECT * FROM view_notes WHERE note_type=? AND note_reference=? ORDER BY note_timestamp DESC,note_serial DESC');$stmt->execute([$type,(int)$reference]);return $this->getTableXML('notes',$stmt);} + public function getAllNotes($reference=0){return $this->getNotes('User',$reference);} + public function addNoteQuick($type='',$reference=0,$text=''){return $this->write(0,$type,(int)$reference,$text);} } - -?> diff --git a/classes/Pagination.php b/classes/Pagination.php new file mode 100644 index 0000000..14db1e9 --- /dev/null +++ b/classes/Pagination.php @@ -0,0 +1,14 @@ +1,'previous'=>$current-1,'next'=>$current+1,'last'=>$last,default=>$current}; + $page=max(1,min($last,$page));$offset=($page-1)*$size; + return ['size'=>$size,'page'=>$page,'offset'=>$offset,'start'=>$count?$offset+1:0,'end'=>min($count,$offset+$size)]; + } + public static function session(string $scope,int $count,int $size,string $action=''): array { + if(!is_array($_SESSION[Base::PAGINATION_PAGE]??null))$_SESSION[Base::PAGINATION_PAGE]=[]; + $result=self::calculate($count,$size,(int)($_SESSION[Base::PAGINATION_PAGE][$scope]??1),$action); + $_SESSION[Base::PAGINATION_PAGE][$scope]=$result['page'];return $result; + } +} diff --git a/classes/Popovers.php b/classes/Popovers.php index aa4091f..62b2845 100644 --- a/classes/Popovers.php +++ b/classes/Popovers.php @@ -28,7 +28,7 @@ class Popovers extends Base { $this->current_user_name = $_SESSION[self::USER_NAME] ?? ""; $this->current_user_email = $_SESSION[self::USER_EMAIL] ?? ""; - $this->pagination_page = $_SESSION[self::PAGINATION_PAGE] ?? 1; + $this->pagination_page = 1; } // =========== @@ -229,7 +229,7 @@ class Popovers extends Base { // Find Criteria $find_popover = filter_input(INPUT_POST, "find_popover") ?: ""; - $find_words = $this->sanitizeString($find_popover); + $find_words = preg_quote(trim($find_popover)); // Show Per Page @@ -259,21 +259,9 @@ class Popovers extends Base { $pagination = filter_input(INPUT_POST, "pagination") ?: ""; - switch ($pagination) { - - case "first" : $this->pagination_page = 1; - break; - case "previous" : $this->pagination_page = max(($this->pagination_page - 1), 1); - break; - case "next" : $this->pagination_page = ($this->pagination_page + 1); - break; - case "last" : $this->pagination_page = ($count / $this->pagination_size); - break; - } - - $offset = (($this->pagination_page * $this->pagination_size) - $this->pagination_size); - $start = ($offset + 1); - $end = min($count, (($start + $this->pagination_size) - 1)); + $paging=Pagination::session(__METHOD__,$count,(int)$this->pagination_size,$pagination); + $this->pagination_size=$paging['size'];$this->pagination_page=$paging['page']; + $offset=$paging['offset'];$start=$paging['start'];$end=$paging['end']; // Data @@ -281,6 +269,7 @@ class Popovers extends Base { from view_popovers where popover_name regexp :popover_name or popover_title regexp :popover_title + order by popover_serial limit {$this->pagination_size} offset {$offset}"; @@ -300,7 +289,6 @@ class Popovers extends Base { $popovers->addAttribute("end", $end); $popovers->addAttribute("page", $this->pagination_page); - $_SESSION[self::PAGINATION_PAGE] = $this->pagination_page; return $popovers; } diff --git a/classes/Reports.php b/classes/Reports.php index b399320..7fbf720 100644 --- a/classes/Reports.php +++ b/classes/Reports.php @@ -1,479 +1,5 @@ current_user_name = $_SESSION[self::USER_NAME] ?? ""; - $this->current_user_email = $_SESSION[self::USER_EMAIL] ?? ""; - - $this->pagination_page = $_SESSION[self::PAGINATION_PAGE] ?? 1; - } - - // ========== - // Add Report - // ========== - - public function addReport() { - - $step = filter_input(INPUT_POST, "step") ?: "prompt"; - - switch ($step) { - - case "prompt": - - $constants = $this->getConstants(); - - $XML = $this->mergeXML($constants, ""); - - $content = $this->applyXSL($XML, $this->getXSL("addReport")); - - $this->displayContent($content); - - break; - - case "add": - - $report_name = filter_input(INPUT_POST, "report_name") ?: ""; - $report_class = filter_input(INPUT_POST, "report_class") ?: ""; - $report_type = filter_input(INPUT_POST, "report_type") ?: "Report"; - $report_description = filter_input(INPUT_POST, "report_description") ?: ""; - $report_target = filter_input(INPUT_POST, "report_target") ?: ""; - - $report_class = trim(preg_replace("/\s+/", " ", $report_class)); - - $SQL = "insert into reports - - ( report_class, - report_type, - report_name, - report_description, - report_target ) - - VALUES ( :report_class, - :report_type, - :report_name, - :report_description, - :report_target)"; - - $statement = $this->connect()->prepare($SQL); - - $statement->bindValue(":report_class", $report_class); - $statement->bindValue(":report_type", $report_type); - $statement->bindValue(":report_name", $report_name); - $statement->bindValue(":report_description", $report_description); - $statement->bindValue(":report_target", $report_target); - - $statement->execute(); - - break; - - default: - - $this->displayHome(); - } - } - - // ============= - // Delete Report - // ============= - - public function deleteReport() { - - $report_serial = filter_input(INPUT_POST, "report_serial", FILTER_SANITIZE_NUMBER_INT) ?: 0; - - $reports = $this->getReport($report_serial); - - if ($reports->count() == 0) { - $this->logError("Invalid Report ({$report_serial}): " . __METHOD__); - } - - $SQL = "delete from reports - where report_serial = {$report_serial}"; - - $this->executeSQL($SQL); - } - - // =========== - // Edit Report - // =========== - - public function editReport() { - - $step = filter_input(INPUT_POST, "step") ?: "prompt"; - - switch ($step) { - - case "prompt": - - $report_serial = filter_input(INPUT_POST, "report_serial", FILTER_SANITIZE_NUMBER_INT) ?: 0; - - $reports = $this->getReport($report_serial); - - if ($reports->count() == 0) { - $this->logError("Invalid Report ({$report_serial}): " . __METHOD__); - } - - $constants = $this->getConstants(); - - $XML = $this->mergeXML($reports, ""); - $XML = $this->mergeXML($constants, $XML); - - $content = $this->applyXSL($XML, $this->getXSL("editReport")); - - $this->displayContent($content); - - break; - - case "update": - - $report_serial = filter_input(INPUT_POST, "report_serial", FILTER_SANITIZE_NUMBER_INT) ?: 0; - $report_name = filter_input(INPUT_POST, "report_name") ?: ""; - $report_class = filter_input(INPUT_POST, "report_class") ?: ""; - $report_type = filter_input(INPUT_POST, "report_type") ?: "Report"; - $report_description = filter_input(INPUT_POST, "report_description") ?: ""; - $report_target = filter_input(INPUT_POST, "report_target") ?: ""; - - $report_class = trim(preg_replace("/\s+/", " ", $report_class)); - - $reports = $this->getReport($report_serial); - - if ($reports->count() == 0) { - $this->logError("Invalid Report ({$report_serial}): " . __METHOD__); - } - - $SQL = "update reports - set report_class = :report_class, - report_type = :report_type, - report_name = :report_name, - report_description = :report_description, - report_target = :report_target - where report_serial = :report_serial"; - - $statement = $this->connect()->prepare($SQL); - - $statement->bindValue(":report_serial", $report_serial); - $statement->bindValue(":report_class", $report_class); - $statement->bindValue(":report_type", $report_type); - $statement->bindValue(":report_name", $report_name); - $statement->bindValue(":report_description", $report_description); - $statement->bindValue(":report_target", $report_target); - - $statement->execute(); - - break; - - default: - - $this->displayHome(); - } - } - - // ====================== - // Return a Report Object - // ====================== - - public function getReport($report_serial = 0) { - - $SQL = "select view_reports.* - from view_reports - where report_serial = {$report_serial}"; - - return $this->getTable("reports", $SQL); - } - - // =========================================== - // Return the report_serial for a report_class - // =========================================== - - public function getReportSerial($report_class = "") { - - $SQL = "select view_reports.report_serial - from view_reports - where report_class = '{$report_class}'"; - - $reports = $this->getTable("reports", $SQL); - - return (int) ($reports->record->report_serial ?? 0); - } - - // ======================= - // Return a Reports Object - // ======================= - - public function getReports() { - - $SQL = "select view_reports.* - from view_reports"; - - return $this->getTable("reports", $SQL); - } - - // ============================ - // Return a Reports Page Object - // ============================ - - public function getReportsPage() { - - // Find Criteria - - $find_report = filter_input(INPUT_POST, "find_report") ?: ""; - $find_words = $this->sanitizeString($find_report); - -// $find_words = implode("|", explode(" ", $find_report)); - // Show Per Page - - $this->pagination_size = filter_input(INPUT_POST, "reports_per_page", FILTER_SANITIZE_NUMBER_INT) ?: $this->pagination_size; - - // Record Count - - $connection = $this->connect(); - - $SQL = "select count(*) as count - from view_reports - where (report_class regexp :report_class - or report_name regexp :report_name - or report_type regexp :report_type - or report_description regexp :report_description)"; - - $statement = $connection->prepare($SQL); - - $statement->bindValue(":report_class", $find_words); - $statement->bindValue(":report_name", $find_words); - $statement->bindValue(":report_type", $find_words); - $statement->bindValue(":report_description", $find_words); - - $statement->execute(); - - $recordset = $statement->fetch(PDO::FETCH_ASSOC); - - $count = (count($recordset) > 0) ? (int) $recordset["count"] : (int) 0; - - // Pagination - - $pagination = filter_input(INPUT_POST, "pagination") ?: ""; - - switch ($pagination) { - - case "first" : $this->pagination_page = 1; - break; - case "previous" : $this->pagination_page = max(($this->pagination_page - 1), 1); - break; - case "next" : $this->pagination_page = ($this->pagination_page + 1); - break; - case "last" : $this->pagination_page = ($count / $this->pagination_size); - break; - } - - $offset = (($this->pagination_page * $this->pagination_size) - $this->pagination_size); - $start = ($offset + 1); - $end = min($count, (($start + $this->pagination_size) - 1)); - - // Data - - $SQL = "select view_reports.* - from view_reports - where (report_class regexp :report_class - or report_name regexp :report_name - or report_type regexp :report_type - or report_description regexp :report_description) - limit {$this->pagination_size} - offset {$offset}"; - - $statement = $connection->prepare($SQL); - - $statement->bindValue(":report_class", $find_words); - $statement->bindValue(":report_name", $find_words); - $statement->bindValue(":report_type", $find_words); - $statement->bindValue(":report_description", $find_words); - - $statement->execute(); - - $reports = $this->getTableXML("reports", $statement); - - // Insert Pagination Attributes - - $reports->addAttribute("count", $count); - $reports->addAttribute("start", $start); - $reports->addAttribute("end", $end); - $reports->addAttribute("page", $this->pagination_page); - - $_SESSION[self::PAGINATION_PAGE] = $this->pagination_page; - - return $reports; - } - - // ================================== - // Return a Select Report Page Object - // ================================== - - public function getSelectReportPage() { - - // Find Criteria - - $select_report = filter_input(INPUT_POST, "select_report") ?: ""; - $find_words = $this->sanitizeString($select_report); - - // Show Per Page - - $this->pagination_size = filter_input(INPUT_POST, "reports_per_page", FILTER_SANITIZE_NUMBER_INT) ?: $this->pagination_size; - - // Record Count - - $connection = $this->connect(); - - $SQL = "select count(*) as count - from view_reports - where report_name regexp :report_name - or report_description regexp :report_description"; - - $statement = $connection->prepare($SQL); - - $statement->bindValue(":report_name", $find_words); - $statement->bindValue(":report_description", $find_words); - - $statement->execute(); - - $recordset = $statement->fetch(PDO::FETCH_ASSOC); - - $count = (count($recordset) > 0) ? (int) $recordset["count"] : (int) 0; - - // Pagination - - $pagination = filter_input(INPUT_POST, "pagination") ?: ""; - - switch ($pagination) { - - case "first" : $this->pagination_page = 1; - break; - case "previous" : $this->pagination_page = max(($this->pagination_page - 1), 1); - break; - case "next" : $this->pagination_page = ($this->pagination_page + 1); - break; - case "last" : $this->pagination_page = ($count / $this->pagination_size); - break; - } - - $offset = (($this->pagination_page * $this->pagination_size) - $this->pagination_size); - $start = ($offset + 1); - $end = min($count, (($start + $this->pagination_size) - 1)); - - // Data - - $SQL = "select view_reports.* - from view_reports - where report_name regexp :report_name - or report_description regexp :report_description - limit {$this->pagination_size} - offset {$offset}"; - - $statement = $connection->prepare($SQL); - - $statement->bindValue(":report_name", $find_words); - $statement->bindValue(":report_description", $find_words); - - $statement->execute(); - - $reports = $this->getTableXML("reports", $statement); - - // Insert Pagination Attributes - - $reports->addAttribute("count", $count); - $reports->addAttribute("start", $start); - $reports->addAttribute("end", $end); - $reports->addAttribute("page", $this->pagination_page); - - $_SESSION[self::PAGINATION_PAGE] = $this->pagination_page; - - return $reports; - } - - // ==================================== - // Determine if the Report Class Exists - // ==================================== - - public function reportExists() { - - $exists = false; - - $report_serial = filter_input(INPUT_POST, "report_serial", FILTER_SANITIZE_NUMBER_INT) ?: 0; - $report_class = filter_input(INPUT_POST, "report_class") ?: ""; - - $report_class = trim(preg_replace("/\s+/", " ", $report_class)); - - $SQL = "select report_serial - from view_reports - where report_serial != :report_serial - and lower(report_class) = :report_class"; - - $statement = $this->connect()->prepare($SQL); - - $statement->bindValue(":report_serial", $report_serial); - $statement->bindValue(":report_class", $report_class); - - $statement->execute(); - - $recordset = $statement->fetchAll(PDO::FETCH_ASSOC); - - $exists = (count($recordset) > 0) ? true : false; - - echo json_encode($exists); - } - - // ================ - // Select a Report. - // ================ - - public function selectReport() { - - $reports = $this->getSelectReportPage(); - $popovers = (new Popovers())->getPopovers(); - - $XML = $this->mergeXML($reports, ""); - $XML = $this->mergeXML($popovers, $XML); - - $content = $this->applyXSL($XML, $this->getXSL("selectReport")); - - $this->displayContent($content); - } - - // ============= - // Setup Reports - // ============= - - public function setupReports() { - - $reports = $this->getReportsPage(); - $popovers = (new Popovers())->getPopovers(); - - $XML = $this->mergeXML($reports, ""); - $XML = $this->mergeXML($popovers, $XML); - - $content = $this->applyXSL($XML, $this->getXSL("setupReports")); - - $this->displayContent($content); - } + public function selectReport(){(new RosterReports())->catalog();} + public function setupReports(){(new RosterReports())->catalog();} } - -?> diff --git a/classes/Roster.php b/classes/Roster.php new file mode 100644 index 0000000..7d28818 --- /dev/null +++ b/classes/Roster.php @@ -0,0 +1,97 @@ +'; + } + private static function field(string $name,string $label,string $type='text',string $value='',int $max=128): string { + $id=$name.'_'.bin2hex(random_bytes(3)); + return '
'; + } + public function help(): void { + $this->displayContent('

Using your club workspace

Open Clubs and dues to view clubs assigned to your account. Club rosters and your season dues are available inside each club.

Site administrators create clubs, assign existing accounts, add seasons, and record dues and received payments. Contact your club administrator for membership or account assistance.

'); + } + public function home(): void { + $service=new RosterService();$html='

Club workspace

Club access requires a verified email. Verify your email or request another link.

'; + if(!$service->ready()){ + $html.=$service->administrator()?'

Club setup is ready to install. Run the database migrations described in PRODUCTION-FIXES.md.

':'

Your club workspace is being prepared. Please contact the site administrator.

'; + }else{ + $clubs=$service->clubs(); + if(!$clubs)$html.='

You are not assigned to an active club yet. A site administrator can create clubs and assign memberships.

'; + foreach($clubs as $club)$html.='

'.self::h($club['club_name']).'

'.self::h(ucfirst($club['club_status'])).'

Open club
'; + $html.=''.($service->administrator()?'Manage clubs and memberships':'View my clubs and dues').''; + } + $this->displayContent($html.'
'); + } + private function financialHistory(int $club,bool $active,bool $admin): string { + $history=(new LedgerService())->history($club);$html='

Payment history

'; + if($admin)$html.='
'; + $html.='
'; + foreach($history['payments'] as $p){ + $html.=''; + } + $html.='
PaymentMemberDateAmountMethod / referenceRecorded byStatus
#'.(int)$p['payment_serial'].''.self::h($p['member_name']).''.self::h($p['paid_on']).'$'.number_format($p['amount_cents']/100,2).''.self::h($p['payment_method'].' '.$p['payment_reference']).''.self::h($p['actor']??'Historical record').''; + if($p['reversal_serial'])$html.='Reversed: '.self::h($p['reversal_reason'].' by '.$p['reversal_actor'].' on '.$p['reversed_at']); + elseif($admin&&$active)$html.='
Reverse incorrect payment

This preserves the original entry and restores the amount owed. It does not send a refund.

'.$this->form('reverse',$club).''.self::field('reason','Reversal reason','text','',500).'
'; + else $html.='Received';$html.='

Dues correction history

    '; + foreach($history['adjustments'] as $a)$html.='
  • '.self::h($a['member_name']).': $'.number_format($a['amount_cents']/100,2).' adjustment; corrected total $'.number_format($a['corrected_amount_cents']/100,2).' — '.self::h($a['reason'].' ('.$a['actor'].', '.$a['created_at'].')').'
    • '; + return $html.'
'; + } + public function workspace(): void { + $service=new RosterService();if(!$service->ready()){$this->home();return;} + $clubRaw=$_POST['club_serial']??$_GET['club_serial']??'';$club=($clubRaw===''||$clubRaw==='0')?0:MaintenanceService::id($clubRaw); + if(($_SERVER['REQUEST_METHOD']??'GET')==='POST' && ($_POST['step']??'')!==''){ + $service->requireAdministrator();$this->requireCsrf(); + switch($_POST['step']){ + case 'club':$club=$service->saveClub($club,$_POST['club_name']??'',$_POST['club_status']??'active');break; + case 'member':$service->saveMember($club,empty($_POST['membership_serial'])?0:MaintenanceService::id($_POST['membership_serial']),$_POST['identifier']??'',$_POST['membership_status']??'active',$_POST['joined_on']??'');break; + case 'season':$service->addSeason($club,$_POST['season_name']??'',$_POST['starts_on']??'',$_POST['ends_on']??'');break; + case 'charge':$service->charge($club,MaintenanceService::id($_POST['membership_serial']??null),MaintenanceService::id($_POST['season_serial']??null),$_POST['amount']??'');break; + case 'payment':$service->payment($club,MaintenanceService::id($_POST['due_serial']??null),$_POST['amount']??'',$_POST['paid_on']??'',$_POST['request_key']??'',$_POST['payment_method']??'unspecified',$_POST['payment_reference']??'');break; + case 'adjust':(new LedgerService())->adjust($club,MaintenanceService::id($_POST['due_serial']??null),$_POST['corrected_amount']??'',$_POST['reason']??'',$_POST['request_key']??'');break; + case 'reverse':(new LedgerService())->reverse($club,MaintenanceService::id($_POST['payment_serial']??null),$_POST['reason']??'',$_POST['request_key']??'');break; + default:throw new AppException('Unknown club action.'); + } + $_SESSION['roster_notice']='Changes saved.';header('Location: main.php?Xaction=Roster.workspace&club_serial='.$club,true,303);exit; + } + $html='

Clubs and memberships

'; + if(!empty($_SESSION['roster_notice'])){$html.='

'.self::h($_SESSION['roster_notice']).'

';unset($_SESSION['roster_notice']);} + $clubs=$service->clubs();$html.=''; + if($service->administrator())$html.='

Create club

'.$this->form('club').self::field('club_name','Club name').'
'; + if(!$club && $clubs)$club=(int)$clubs[0]['club_serial']; + if(!$club){$this->displayContent($html.'

No clubs are available.

');return;} + $selected=$service->club($club);$members=$service->members($club);$seasons=$service->seasons($club);$dues=$service->dues($club); + $html.='

'.self::h($selected['club_name']).'

'; + if($service->administrator()){ + $html.='
Edit or archive club'.$this->form('club',$club).self::field('club_name','Club name','text',$selected['club_name']).'
'; + } + $html.='

Roster

'.($service->administrator()?'':'').''; + foreach($members as $member){ + $html.=''; + if($service->administrator())$html.=''; + $html.=''; + } + if(!$members)$html.=''; + $html.='
NameEmailMembershipJoinedUpdate membership
'.self::h($member['user_first_name'].' '.$member['user_last_name']).''.self::h($member['user_email']).''.self::h($member['membership_status']).''.self::h($member['joined_on']).''.$this->form('member',$club).'
No members assigned.
'; + if($service->administrator() && $selected['club_status']==='active')$html.='

Assign an existing account

'.$this->form('member',$club).self::field('identifier','Username or email').self::field('joined_on','Joined on','date',date('Y-m-d')).'

Create or invite accounts through Users before assigning them to a club.

'; + $html.='

Seasons

    '; + foreach($seasons as $season)$html.='
  • '.self::h($season['season_name'].' ('.$season['starts_on'].' to '.$season['ends_on'].')').'
    • '; + $html.='
'; + if($service->administrator() && $selected['club_status']==='active')$html.=$this->form('season',$club).self::field('season_name','Season name','text','',100).self::field('starts_on','Starts on','date').self::field('ends_on','Ends on','date').'
'; + $html.='

'.($service->administrator()?'Season dues':'My season dues').'

Amounts are in USD. Payments below are manually recorded receipts.

'.($service->administrator()?'':'').''; + foreach($dues as $due){$balance=(int)$due['amount_cents']-(int)$due['paid_cents'];$html.=''; + if($service->administrator()){$html.='';}$html.=''; + } + if(!$dues)$html.='';$html.='
MemberSeasonDuesPaidBalanceRecord received payment
'.self::h($due['user_first_name'].' '.$due['user_last_name']).''.self::h($due['season_name']).'$'.number_format($due['amount_cents']/100,2).'$'.number_format($due['paid_cents']/100,2).'$'.number_format($balance/100,2).'';if($balance>0 && $selected['club_status']==='active')$html.=$this->form('payment',$club).''.self::field('amount','Payment (USD)','text').self::field('paid_on','Received on','date',date('Y-m-d')).'';if($selected['club_status']==='active')$html.='
Correct dues'.$this->form('adjust',$club).''.self::field('corrected_amount','Corrected total (USD)').self::field('reason','Reason','text','',500).'
';$html.='
No dues recorded.
'; + if($service->administrator() && $selected['club_status']==='active' && $members && $seasons){ + $html.='

Record season dues

'.$this->form('charge',$club).'
'.self::field('amount','Dues (USD)','text').'
'; + } + $html.=$this->financialHistory($club,$selected['club_status']==='active',$service->administrator()); + $this->displayContent($html.''); + } +} + diff --git a/classes/RosterReports.php b/classes/RosterReports.php new file mode 100644 index 0000000..0c90ca3 --- /dev/null +++ b/classes/RosterReports.php @@ -0,0 +1,43 @@ +requireAdministrator();$club=MaintenanceService::id($_POST['club_serial']??null);$name=$service->club($club)['club_name']; + $history=(new LedgerService())->history($club);header('Content-Type: text/csv; charset=UTF-8');header('Content-Disposition: attachment; filename="club-financial-history.csv"');$file=fopen('php://output','w'); + $write=static function(array $row)use($file){fputcsv($file,array_map(static fn($v)=>self::csvText((string)$v),$row),',','"','');}; + $write(['Record type','Club','Record ID','Dues ID','Member','Amount cents (USD)','Date','Method','Reference','Recorded by','Status / reason']); + foreach($service->dues($club) as $due)$write(['dues_total',$name,$due['due_serial'],$due['due_serial'],$due['user_first_name'].' '.$due['user_last_name'],$due['amount_cents'],'','','',$due['recorded_by']??'Historical','Paid cents '.$due['paid_cents'].'; balance cents '.($due['amount_cents']-$due['paid_cents'])]); + foreach($history['payments'] as $p)$write(['payment',$name,$p['payment_serial'],$p['due_serial'],$p['member_name'],$p['amount_cents'],$p['paid_on'],$p['payment_method'],$p['payment_reference'],$p['actor']??'Historical',$p['reversal_serial']?'Reversed: '.$p['reversal_reason'].' by '.$p['reversal_actor'].' on '.$p['reversed_at']:'Received']); + foreach($history['adjustments'] as $a)$write(['dues_adjustment',$name,$a['adjustment_serial'],$a['due_serial'],$a['member_name'],$a['amount_cents'],$a['created_at'],'','',$a['actor'],$a['reason']]); + fclose($file);exit; + } + private function rows(): array { + $service=new RosterService();$service->requireAdministrator();$id=MaintenanceService::id($_POST['club_serial']??null);$club=$service->club($id); + $rows=[['Club','Username','First name','Last name','Email','Membership','Joined on']]; + foreach($service->members($id) as $member)$rows[]=[$club['club_name'],$member['user_name'],$member['user_first_name'],$member['user_last_name'],$member['user_email'],$member['membership_status'],$member['joined_on']]; + return $rows; + } + public static function csvText(string $value): string {return preg_match('/\A[\s]*[=+@\-]/u',$value)||preg_match('/\A[\t\r\n]/',$value)?"'".$value:$value;} + public function csv(): void { + $rows=$this->rows();header('Content-Type: text/csv; charset=UTF-8');header('Content-Disposition: attachment; filename="club-roster.csv"');$file=fopen('php://output','w'); + foreach($rows as $row)fputcsv($file,array_map(static fn($cell)=>self::csvText((string)$cell),$row),',','"','');fclose($file);exit; + } + public function excel(): void { + $rows=$this->rows();$book=new Spreadsheet();$sheet=$book->getActiveSheet();$sheet->setTitle('Club roster'); + foreach($rows as $r=>$row)foreach($row as $c=>$cell)$sheet->setCellValueExplicit([$c+1,$r+1],(string)$cell,DataType::TYPE_STRING); + $sheet->getStyle('A1:G1')->getFont()->setBold(true);$sheet->freezePane('A2');foreach(range('A','G') as $column)$sheet->getColumnDimension($column)->setAutoSize(true); + header('Content-Type: application/vnd.openxmlformats-officedocument.spreadsheetml.sheet');header('Content-Disposition: attachment; filename="club-roster.xlsx"');(new Xlsx($book))->save('php://output');exit; + } + public function pdf(): void { + $rows=$this->rows();$pdf=new TCPDF('L');$pdf->SetCreator(self::APPLICATION_NAME);$pdf->SetTitle('Club roster');$pdf->setPrintHeader(false);$pdf->setPrintFooter(false);$pdf->AddPage();$pdf->SetFont('helvetica','',9); + $html='

Club roster

';foreach($rows as $r=>$row){$html.='';foreach($row as $cell)$html.=($r===0?'');$html.='';}$html.='
':'').htmlspecialchars((string)$cell,ENT_QUOTES,'UTF-8').($r===0?'':'
';$pdf->writeHTML($html);$pdf->Output('club-roster.pdf','D');exit; + } + public function catalog(): void { + $service=new RosterService();$service->requireAdministrator();$html='

Roster reports

'; + if(!$service->ready()){$this->displayContent($html.'

Install the roster migration before exporting reports.

');return;} + foreach($service->clubs() as $club){$html.='

'.htmlspecialchars($club['club_name'],ENT_QUOTES,'UTF-8').'

';foreach(['csv'=>'CSV','excel'=>'Excel','pdf'=>'PDF'] as $method=>$label)$html.='
';$html.='
';} + $this->displayContent($html.''); + } +} diff --git a/classes/RosterService.php b/classes/RosterService.php new file mode 100644 index 0000000..d39e9ef --- /dev/null +++ b/classes/RosterService.php @@ -0,0 +1,70 @@ +administrator())throw new AppException('Only site administrators may manage clubs and dues.',403);} + public function ready(): bool {return (int)$this->connect()->query("SELECT COUNT(*) FROM information_schema.TABLES WHERE TABLE_SCHEMA=DATABASE() AND TABLE_NAME IN ('clubs','club_memberships','club_seasons','club_dues','club_payments','club_due_adjustments','club_payment_reversals','email_verifications')")->fetchColumn()===8;} + public function clubs(): array { + $db=$this->connect(); + if($this->administrator())return $db->query('SELECT * FROM clubs ORDER BY club_name,club_serial')->fetchAll(); + $stmt=$db->prepare("SELECT c.* FROM clubs c JOIN club_memberships m ON m.club_serial=c.club_serial JOIN users u ON u.user_serial=m.user_serial WHERE m.user_serial=? AND m.membership_status='active' AND c.club_status='active' AND u.user_status='active' AND u.user_email_verified_at IS NOT NULL ORDER BY c.club_name,c.club_serial"); + $stmt->execute([$_SESSION[self::USER_SERIAL]??0]);return $stmt->fetchAll(); + } + public function club(int $id,?PDO $db=null,bool $writing=false): array { + $db??=$this->connect();$stmt=$db->prepare('SELECT * FROM clubs WHERE club_serial=?'.($writing?' FOR UPDATE':''));$stmt->execute([$id]);$club=$stmt->fetch(); + if(!$club)throw new AppException('Club not found.',404); + if(!$this->administrator()){ + $stmt=$db->prepare("SELECT m.membership_serial FROM club_memberships m JOIN users u ON u.user_serial=m.user_serial WHERE m.club_serial=? AND m.user_serial=? AND m.membership_status='active' AND u.user_status='active' AND u.user_email_verified_at IS NOT NULL");$stmt->execute([$id,$_SESSION[self::USER_SERIAL]??0]); + if($club['club_status']!=='active'||!$stmt->fetch())throw new AppException('You do not have access to this club.',403); + } + if($writing && $club['club_status']!=='active')throw new AppException('Reactivate the club before adding or changing records.',409); + return $club; + } + public function members(int $club): array { + $this->club($club);$stmt=$this->connect()->prepare("SELECT m.*,u.user_name,u.user_first_name,u.user_last_name,u.user_email FROM club_memberships m JOIN users u ON u.user_serial=m.user_serial WHERE m.club_serial=?".($this->administrator()?'':" AND m.membership_status='active'").' ORDER BY u.user_last_name,u.user_first_name,m.membership_serial');$stmt->execute([$club]);return $stmt->fetchAll(); + } + public function seasons(int $club): array {$this->club($club);$stmt=$this->connect()->prepare('SELECT * FROM club_seasons WHERE club_serial=? ORDER BY starts_on DESC,season_serial DESC');$stmt->execute([$club]);return $stmt->fetchAll();} + public function dues(int $club): array { + $this->club($club);$stmt=$this->connect()->prepare('SELECT d.*,d.amount_cents AS original_amount_cents,d.amount_cents+COALESCE((SELECT SUM(a.amount_cents) FROM club_due_adjustments a WHERE a.due_serial=d.due_serial),0) AS amount_cents,s.season_name,u.user_first_name,u.user_last_name,COALESCE((SELECT SUM(p.amount_cents) FROM club_payments p WHERE p.due_serial=d.due_serial AND NOT EXISTS(SELECT 1 FROM club_payment_reversals r WHERE r.payment_serial=p.payment_serial)),0) AS paid_cents FROM club_dues d JOIN club_memberships m ON m.membership_serial=d.membership_serial JOIN users u ON u.user_serial=m.user_serial JOIN club_seasons s ON s.season_serial=d.season_serial WHERE d.club_serial=?'.($this->administrator()?'':' AND m.user_serial=?').' ORDER BY s.starts_on DESC,u.user_last_name,d.due_serial'); + $stmt->execute($this->administrator()?[$club]:[$club,$_SESSION[self::USER_SERIAL]??0]);return $stmt->fetchAll(); + } + private function text(string $text,int $limit): string {$text=trim($text);if(!$text||strlen($text)>$limit)throw new AppException('A name is required and must fit the displayed length limit.');return $text;} + public static function date(string $value): string {$date=DateTime::createFromFormat('!Y-m-d',$value);if(!$date||$date->format('Y-m-d')!==$value)throw new AppException('Enter a valid date in YYYY-MM-DD format.');return $value;} + public static function cents(string $value): int { + if(!preg_match('/\A(?:0|[1-9][0-9]{0,6})(?:\.[0-9]{1,2})?\z/',$value))throw new AppException('Enter a nonnegative USD amount with at most two decimal places (maximum 9,999,999.99).'); + [$whole,$fraction]=array_pad(explode('.',$value,2),2,'');return (int)$whole*100+(int)str_pad($fraction,2,'0'); + } + public function saveClub(int $id,string $name,string $status='active'): int { + $this->requireAdministrator();$name=$this->text($name,128);if(!in_array($status,['active','archived'],true))throw new AppException('Invalid club status.'); + $db=$this->connect();$db->beginTransaction(); + try { + $before=null;if($id){$stmt=$db->prepare('SELECT * FROM clubs WHERE club_serial=? FOR UPDATE');$stmt->execute([$id]);$before=$stmt->fetch();if(!$before)throw new AppException('Club not found.',404);} + if($id){$stmt=$db->prepare('UPDATE clubs SET club_name=?,club_status=? WHERE club_serial=?');$stmt->execute([$name,$status,$id]);} + else{$stmt=$db->prepare('INSERT INTO clubs(club_name,club_status) VALUES(?,?)');$stmt->execute([$name,$status]);$id=(int)$db->lastInsertId();} + Audit::required($db,(int)($_SESSION[self::USER_SERIAL]??0),'saved club '.json_encode(['club'=>$id,'before'=>$before,'name'=>$name,'status'=>$status]));$db->commit(); + }catch(Throwable $e){if($db->inTransaction())$db->rollBack();throw $e;} + return $id; + } + public function saveMember(int $club,int $membership,string $identifier,string $status,string $joined): void { + $this->requireAdministrator();$joined=self::date($joined);if(!in_array($status,['active','inactive'],true))throw new AppException('Invalid membership status.'); + $db=$this->connect();$db->beginTransaction(); + try{ + // Lock user before membership writes, matching account deletion's lock order. + if($membership){$stmt=$db->prepare('SELECT user_serial FROM club_memberships WHERE membership_serial=? AND club_serial=?');$stmt->execute([$membership,$club]);$user=$stmt->fetchColumn();if(!$user)throw new AppException('Membership not found in this club.',404);} + else{$stmt=$db->prepare('SELECT user_serial FROM users WHERE user_name=? OR user_email=?');$stmt->execute([trim($identifier),trim($identifier)]);$user=$stmt->fetchColumn();if(!$user)throw new AppException('No account matches that username or email. Create the account first.',404);} + $stmt=$db->prepare('SELECT user_serial,user_status,user_email_verified_at FROM users WHERE user_serial=? FOR UPDATE');$stmt->execute([$user]);if(!($account=$stmt->fetch()))throw new AppException('Account not found.',404); + if($status==='active' && ($account['user_status']!=='active'||!$account['user_email_verified_at']))throw new AppException('The account must be active and its email verified before membership can be activated.',409); + $this->club($club,$db,true); + $before=null;if($membership){$stmt=$db->prepare('SELECT * FROM club_memberships WHERE membership_serial=? AND club_serial=? FOR UPDATE');$stmt->execute([$membership,$club]);$before=$stmt->fetch();if(!$before)throw new AppException('Membership not found.',404);} + if($membership){$stmt=$db->prepare('UPDATE club_memberships SET membership_status=?,joined_on=? WHERE membership_serial=? AND club_serial=?');$stmt->execute([$status,$joined,$membership,$club]);} + else{$stmt=$db->prepare('INSERT INTO club_memberships(club_serial,user_serial,membership_status,joined_on) VALUES(?,?,?,?)');$stmt->execute([$club,$user,$status,$joined]);} + Audit::required($db,(int)($_SESSION[self::USER_SERIAL]??0),'saved membership '.json_encode(['membership'=>$membership?:((int)$db->lastInsertId()),'club'=>$club,'user'=>(int)$user,'before'=>$before,'status'=>$status,'joined_on'=>$joined])); + $db->commit(); + }catch(Throwable $e){if($db->inTransaction())$db->rollBack();throw $e;} + } + public function addSeason(int $club,string $name,string $start,string $end): void { + $this->requireAdministrator();$name=$this->text($name,100);self::date($start);self::date($end);if($end<$start)throw new AppException('Season end cannot precede its start.'); + $db=$this->connect();$db->beginTransaction();try{$this->club($club,$db,true);$stmt=$db->prepare('INSERT INTO club_seasons(club_serial,season_name,starts_on,ends_on) VALUES(?,?,?,?)');$stmt->execute([$club,$name,$start,$end]);Audit::required($db,(int)($_SESSION[self::USER_SERIAL]??0),'created season '.json_encode(['season'=>(int)$db->lastInsertId(),'club'=>$club,'name'=>$name,'start'=>$start,'end'=>$end]));$db->commit();}catch(Throwable $e){if($db->inTransaction())$db->rollBack();throw $e;} + } + public function charge(int $club,int $membership,int $season,string $amount): void {(new LedgerService())->charge($club,$membership,$season,$amount);} + public function payment(int $club,int $due,string $amount,string $paid,string $key,string $method='unspecified',string $reference=''): void {(new LedgerService())->payment($club,$due,$amount,$paid,$key,$method,$reference);} +} diff --git a/classes/SignUp.php b/classes/SignUp.php index 15368bd..d482bfe 100644 --- a/classes/SignUp.php +++ b/classes/SignUp.php @@ -12,6 +12,8 @@ class SignUp extends Base { throw new InvalidArgumentException('Too many account requests. Please try again later.'); } $auth->register($_POST); + try{(new EmailVerification())->request($_POST['user_email']);} + catch(Throwable $e){error_log('Signup verification delivery failed: '.$e->getMessage());} $_SESSION['signup_success'] = true; header('Location: main.php?Xaction=signup', true, 303); exit; diff --git a/classes/Statuses.php b/classes/Statuses.php index 0234e80..497ec1f 100644 --- a/classes/Statuses.php +++ b/classes/Statuses.php @@ -26,7 +26,7 @@ class Statuses extends Base { $this->current_user_name = $_SESSION[self::USER_NAME] ?? ""; $this->current_user_email = $_SESSION[self::USER_EMAIL] ?? ""; - $this->pagination_page = $_SESSION[self::PAGINATION_PAGE] ?? 1; + $this->pagination_page = 1; } // ========== @@ -48,34 +48,7 @@ class Statuses extends Base { break; case "add": - - $status_name = filter_input(INPUT_POST, "status_name") ?: ""; - $status_classes = filter_input(INPUT_POST, "status_classes") ?: ""; - $status_active = filter_input(INPUT_POST, "status_active", FILTER_VALIDATE_BOOLEAN) ?: false; - - $SQL = "insert into statuses - - ( status_name, - status_classes, - status_active, - status_creator, - status_created ) - - VALUES ( :status_name, - :status_classes, - :status_active, - :status_creator, - :status_created )"; - - $statement = $this->connect()->prepare($SQL); - - $statement->bindValue(":status_name", $status_name); - $statement->bindValue(":status_classes", $status_classes); - $statement->bindValue(":status_active", $status_active, PDO::PARAM_BOOL); - $statement->bindValue(":status_creator", $this->current_user_name); - $statement->bindValue(":status_created", $this->getTimestamp()); - - $statement->execute(); + (new MaintenanceService())->saveStatus(0,$_POST); break; @@ -90,19 +63,7 @@ class Statuses extends Base { // ============= public function deleteStatus() { - - $status_serial = filter_input(INPUT_POST, "status_serial", FILTER_SANITIZE_NUMBER_INT) ?: 0; - - $status = $this->getStatus($status_serial); - - if ($status->count() == 0) { - $this->logError("Invalid Status ({$status_serial}). " . __METHOD__); - } - - $SQL = "delete from statuses - where status_serial = {$status_serial}"; - - $this->executeSQL($SQL); + (new MaintenanceService())->deleteStatus(MaintenanceService::id($_POST['status_serial']??null)); } // ============================ @@ -138,21 +99,10 @@ class Statuses extends Base { // ====================================== public function statusActive() { - - $status_serial = filter_input(INPUT_POST, "status_serial", FILTER_SANITIZE_NUMBER_INT) ?: 0; - - $active = false; - - $SQL = "select workorder_status - from workorders - where workorder_status = {$status_serial} - limit 1"; - - $workorders = $this->getTable("workorders", $SQL); - - $active = ($workorders->count() > 0) ? true : false; - - echo json_encode($active); + $stmt=$this->connect()->prepare('SELECT status_default FROM statuses WHERE status_serial=?'); + $stmt->execute([MaintenanceService::id($_POST['status_serial']??null)]);$row=$stmt->fetch(); + if(!$row)throw new AppException('Status not found.',404); + echo json_encode((bool)$row['status_default']); } // ============= @@ -184,41 +134,7 @@ class Statuses extends Base { break; case "update": - - $status_serial = filter_input(INPUT_POST, "status_serial", FILTER_SANITIZE_NUMBER_INT) ?: 0; - $status_name = filter_input(INPUT_POST, "status_name") ?: ""; - $status_classes = filter_input(INPUT_POST, "status_classes") ?: ""; - $status_active = filter_input(INPUT_POST, "status_active", FILTER_VALIDATE_BOOLEAN) ?: false; - $status_default = filter_input(INPUT_POST, "status_default", FILTER_VALIDATE_BOOLEAN) ?: false; - - // Verify the Status - - $status = $this->getStatus($status_serial); - - if ($status->count() == 0) { - $this->logError("Invalid Status ({$status_serial}). " . __METHOD__); - } - - $SQL = "update statuses - set status_name = :status_name, - status_classes = :status_classes, - status_active = :status_active, - status_default = :status_default, - status_changer = :status_changer, - status_changed = :status_changed - where status_serial = :status_serial"; - - $statement = $this->connect()->prepare($SQL); - - $statement->bindValue(":status_serial", $status_serial); - $statement->bindValue(":status_name", $status_name); - $statement->bindValue(":status_classes", $status_classes); - $statement->bindValue(":status_active", $status_active, PDO::PARAM_BOOL); - $statement->bindValue(":status_default", $status_default, PDO::PARAM_BOOL); - $statement->bindValue(":status_changer", $this->current_user_name); - $statement->bindValue(":status_changed", $this->getTimestamp()); - - $statement->execute(); + (new MaintenanceService())->saveStatus(MaintenanceService::id($_POST['status_serial']??null),$_POST); break; @@ -284,13 +200,14 @@ class Statuses extends Base { // ============================ public function getStatusesPage() { + $this->pagination_size=(int)($_POST['statuses_per_page']??20); // Find Criteria $find_status = filter_input(INPUT_POST, "find_status") ?: ""; - $find_status = $this->sanitizeString($find_status); + $find_status = trim($find_status); - $find_words = implode("|", explode(" ", $find_status)); + $find_words = implode("|", array_map(static fn($word) => preg_quote($word), explode(" ", $find_status))); // Record Count @@ -316,21 +233,9 @@ class Statuses extends Base { $pagination = filter_input(INPUT_POST, "pagination") ?: ""; - switch ($pagination) { - - case "first" : $this->pagination_page = 1; - break; - case "previous" : $this->pagination_page = max(($this->pagination_page - 1), 1); - break; - case "next" : $this->pagination_page = ($this->pagination_page + 1); - break; - case "last" : $this->pagination_page = ($count / $this->pagination_size); - break; - } - - $offset = (($this->pagination_page * $this->pagination_size) - $this->pagination_size); - $start = ($offset + 1); - $end = min($count, (($start + $this->pagination_size) - 1)); + $paging=Pagination::session(__METHOD__,$count,(int)$this->pagination_size,$pagination); + $this->pagination_size=$paging['size'];$this->pagination_page=$paging['page']; + $offset=$paging['offset'];$start=$paging['start'];$end=$paging['end']; // Data @@ -338,7 +243,7 @@ class Statuses extends Base { from view_statuses where status_name regexp :status_name or status_classes regexp :status_classes - order by status_name + order by status_name,status_serial limit {$this->pagination_size} offset {$offset}"; @@ -358,7 +263,6 @@ class Statuses extends Base { $statuses->addAttribute("end", $end); $statuses->addAttribute("page", $this->pagination_page); - $_SESSION[self::PAGINATION_PAGE] = $this->pagination_page; return $statuses; } diff --git a/classes/Transport.php b/classes/Transport.php new file mode 100644 index 0000000..c1cf988 --- /dev/null +++ b/classes/Transport.php @@ -0,0 +1,8 @@ +filter_var($ip,FILTER_VALIDATE_IP)!==false); + return in_array($server['REMOTE_ADDR']??'',$trusted,true)&&strtolower(trim($server['HTTP_X_FORWARDED_PROTO']??''))==='https'; + } +} diff --git a/classes/Users.php b/classes/Users.php index d107d95..5953238 100644 --- a/classes/Users.php +++ b/classes/Users.php @@ -28,7 +28,7 @@ class Users extends Base { $this->current_user_serial = (int) ($_SESSION[self::USER_SERIAL] ?? 0); $this->current_user_name = $_SESSION[self::USER_NAME] ?? ""; $this->current_user_email = $_SESSION[self::USER_EMAIL] ?? ""; - $this->pagination_page = $_SESSION[self::PAGINATION_PAGE] ?? 1; + $this->pagination_page = 1; } // =========== @@ -62,11 +62,11 @@ class Users extends Base { $this->logError("Invalid User ({$user_serial}). " . __METHOD__); } - $notes = (new Notes())->getAllNotes($user_serial); - $subscriptions = (new Subscriptions())->getAllUsersSubscriptions($user_serial); + $notes = (new Notes())->getNotes('User',(int)$user_serial); + $activity=$this->getLoginActivity($user_serial); $XML = $this->mergeXML($user, ""); - $XML = $this->mergeXML($subscriptions, $XML); + $XML = $this->mergeXML($activity, $XML); $XML = $this->mergeXML($notes, $XML); $content = $this->applyXSL($XML, $this->getXSL("userSummary")); @@ -99,71 +99,7 @@ class Users extends Base { break; case "add": - - $user_name = filter_input(INPUT_POST, "user_name") ?: ""; - $user_first_name = filter_input(INPUT_POST, "user_first_name") ?: ""; - $user_email = filter_input(INPUT_POST, "user_email") ?: ""; - $user_role = filter_input(INPUT_POST, "user_role") ?: ""; - if (!in_array($user_role, ['User', 'Guest', 'Administrator'], true) || !filter_var($user_email, FILTER_VALIDATE_EMAIL) || strlen($user_email) > 100 || !preg_match('/\A[A-Za-z0-9_.-]{3,64}\z/', $user_name)) { - http_response_code(422); exit('Enter a valid username, email address and role.'); - } - - - $user_name = strtoupper(preg_replace("/\s+/", " ", $user_name)); - - $user_random_password = $this->generateRandomPassword(); - $user_temp_password = password_hash($user_random_password, PASSWORD_DEFAULT); - - $user_change_password = (int) true; - $user_active = 'active'; - - // Add the User - - $connection = $this->connect(); - - $SQL = "insert into users - - ( user_name, - user_email, - user_first_name, - user_password_hash, - user_role, - user_change_password, - user_status, - user_creator, - user_created ) - - values ( :user_name, - :user_email, - :user_first_name, - :user_password_hash, - :user_role, - :user_change_password, - :user_status, - :user_creator, - :user_created )"; - - $statement = $connection->prepare($SQL); - - $statement->bindValue(":user_name", $user_name); - $statement->bindValue(":user_email", $user_email); - $statement->bindValue(":user_first_name", $user_first_name); - $statement->bindValue(":user_password_hash", $user_temp_password); - $statement->bindValue(":user_role", $user_role); - $statement->bindValue(":user_change_password", $user_change_password, PDO::PARAM_BOOL); - $statement->bindValue(":user_status", $user_active); - $statement->bindValue(":user_creator", $this->current_user_name); - $statement->bindValue(":user_created", $this->getTimestamp()); - - if (!$statement->execute()) { - trigger_error($statement->errorInfo()[2]); - } - - $user = $this->getUserByUserName($user_name); - - // Send User Credentials - - (new AuthService())->requestReset($user_email); + echo json_encode((new AdminAccounts())->create($_POST)); break; @@ -178,19 +114,7 @@ class Users extends Base { // =========== public function deleteUser() { - - $user_serial = filter_input(INPUT_POST, "user_serial", FILTER_SANITIZE_NUMBER_INT) ?: 0; - - $users = $this->getUser($user_serial); - - if ($users->count() == 0) { - $this->logError("Invalid User ({$user_serial}): " . __METHOD__); - } - - $SQL = "delete from users - where user_serial = {$user_serial}"; - - $this->executeSQL($SQL); + (new MaintenanceService())->deleteUser(MaintenanceService::id($_POST['user_serial']??null)); } // ========= @@ -227,50 +151,7 @@ class Users extends Base { break; case "update": - - $user_serial = filter_input(INPUT_POST, "user_serial", FILTER_SANITIZE_NUMBER_INT) ?: 0; - $user_name = filter_input(INPUT_POST, "user_name") ?: ""; - $user_email = filter_input(INPUT_POST, "user_email") ?: ""; - $user_first_name = filter_input(INPUT_POST, "user_first_name") ?: ""; - $user_role = filter_input(INPUT_POST, "user_role") ?: ""; - if (!in_array($user_role, ['User', 'Guest', 'Administrator'], true) || !filter_var($user_email, FILTER_VALIDATE_EMAIL) || strlen($user_email) > 100 || !preg_match('/\A[A-Za-z0-9_.-]{3,64}\z/', $user_name)) { - http_response_code(422); exit('Enter a valid username, email address and role.'); - } - - $user_active = filter_input(INPUT_POST, 'user_active', FILTER_VALIDATE_BOOLEAN) ? 'active' : 'inactive'; - - $users = $this->getUser($user_serial); - - if ($users->count() == 0) { - $this->logError("Invalid User ({$user_serial}): " . __METHOD__); - } - - // Update the User - - $SQL = "update users - set user_name = :user_name, - user_email = :user_email, - user_first_name = :user_first_name, - user_role = :user_role, - user_auth_version = user_auth_version + 1, - user_status = :user_status, - user_changer = :user_changer, - user_changed = :user_changed - where user_serial = :user_serial"; - - $statement = $this->connect()->prepare($SQL); - - $statement->bindValue(":user_serial", $user_serial); - $statement->bindValue(":user_name", $user_name); - $statement->bindValue(":user_email", $user_email); - $statement->bindValue(":user_first_name", $user_first_name); - $statement->bindValue(":user_role", $user_role); - $statement->bindValue(":user_status", $user_active); - $statement->bindValue(":user_changer", $this->current_user_name); - $statement->bindValue(":user_changed", $this->getTimestamp()); - - $statement->execute(); - + (new MaintenanceService())->updateUser(MaintenanceService::id($_POST['user_serial']??null),$_POST); break; default: @@ -309,7 +190,7 @@ class Users extends Base { public function getUserSerial($user_name = "") { - $users = $this->getUserByUserId($user_name); + $users = $this->getUserByUserName($user_name); return ($users->count() === 0) ? 0 : (int) $users->record->user_serial; } @@ -330,13 +211,14 @@ class Users extends Base { // ========================== public function getUsersPage() { + $this->pagination_size=(int)($_POST['users_per_page']??20); // Find Criteria $find_user = filter_input(INPUT_POST, "find_user") ?: ""; - $find_user = $this->sanitizeString($find_user); + $find_user = trim($find_user); - $find_words = implode("|", explode(" ", $find_user)); + $find_words = implode("|", array_map(static fn($word) => preg_quote($word), explode(" ", $find_user))); // Record Count @@ -346,6 +228,7 @@ class Users extends Base { from view_users where user_name regexp :user_name or user_first_name regexp :user_first_name + or user_last_name regexp :user_last_name or user_email regexp :user_email or user_role regexp :user_role"; @@ -353,6 +236,7 @@ class Users extends Base { $statement->bindValue(":user_name", $find_words); $statement->bindValue(":user_first_name", $find_words); + $statement->bindValue(":user_last_name", $find_words); $statement->bindValue(":user_email", $find_words); $statement->bindValue(":user_role", $find_words); @@ -366,21 +250,9 @@ class Users extends Base { $pagination = filter_input(INPUT_POST, "pagination") ?: ""; - switch ($pagination) { - - case "first" : $this->pagination_page = 1; - break; - case "previous" : $this->pagination_page = max(($this->pagination_page - 1), 1); - break; - case "next" : $this->pagination_page = ($this->pagination_page + 1); - break; - case "last" : $this->pagination_page = ($count / $this->pagination_size); - break; - } - - $offset = (($this->pagination_page * $this->pagination_size) - $this->pagination_size); - $start = ($offset + 1); - $end = min($count, (($start + $this->pagination_size) - 1)); + $paging=Pagination::session(__METHOD__,$count,(int)$this->pagination_size,$pagination); + $this->pagination_size=$paging['size'];$this->pagination_page=$paging['page']; + $offset=$paging['offset'];$start=$paging['start'];$end=$paging['end']; // Data @@ -388,8 +260,10 @@ class Users extends Base { from view_users where user_name regexp :user_name or user_first_name regexp :user_first_name + or user_last_name regexp :user_last_name or user_email regexp :user_email or user_role regexp :user_role + order by user_serial limit {$this->pagination_size} offset {$offset}"; @@ -397,6 +271,7 @@ class Users extends Base { $statement->bindValue(":user_name", $find_words); $statement->bindValue(":user_first_name", $find_words); + $statement->bindValue(":user_last_name", $find_words); $statement->bindValue(":user_email", $find_words); $statement->bindValue(":user_role", $find_words); @@ -411,7 +286,6 @@ class Users extends Base { $users->addAttribute("end", $end); $users->addAttribute("page", $this->pagination_page); - $_SESSION[self::PAGINATION_PAGE] = $this->pagination_page; return $users; } @@ -474,18 +348,9 @@ class Users extends Base { // ============================= public function userActive() { - - $user_serial = (int) filter_input(INPUT_POST, "user_serial", FILTER_SANITIZE_NUMBER_INT) ?: 0; - - $SQL = "select request_serial - from requests - where request_user = {$user_serial}"; - - $requests = $this->getTable("requests", $SQL); - - $active = ($requests->count() > 0) ? true : $active; - - echo json_encode($active); + $id=MaintenanceService::id($_POST['user_serial']??null); + $used=(new MaintenanceService())->userUsed($id); + echo json_encode($used || $id===(int)($_SESSION[self::USER_SERIAL]??0)); } // =============== @@ -514,12 +379,10 @@ class Users extends Base { public function resetPassword() { $this->requireCsrf(); - $stmt = $this->connect()->prepare('SELECT user_email FROM users WHERE user_serial = :id'); - $stmt->execute([':id' => (int) ($_POST['user_serial'] ?? 0)]); - $email = $stmt->fetchColumn(); - if ($email) (new AuthService())->requestReset($email); - header('Content-Type: application/json'); - echo json_encode(true); + $stmt=$this->connect()->prepare('SELECT user_email FROM users WHERE user_serial=?');$stmt->execute([MaintenanceService::id($_POST['user_serial']??null)]);$email=$stmt->fetchColumn(); + if(!$email)throw new AppException('Account not found.',404); + if(!(new AuthService())->requestReset($email))throw new AppException('The invitation is rate limited or the account is inactive. Try again later.',429); + echo json_encode(['ok'=>true,'message'=>'A password setup link was sent.']); } // =============================================== @@ -545,27 +408,7 @@ class Users extends Base { // ==================== public function updateActiveStatus() { - - $user_serial = filter_input(INPUT_POST, "user_serial", FILTER_SANITIZE_NUMBER_INT) ?: 0; - $user_active = filter_input(INPUT_POST, 'user_active', FILTER_VALIDATE_BOOLEAN) ? 'active' : 'inactive'; - - $SQL = "update users - set user_status = :user_status, - user_auth_version = user_auth_version + 1, - user_changed = :user_changed, - user_changer = :user_changer - where user_serial = :user_serial"; - - $statement = $this->connect()->prepare($SQL); - - $statement->bindValue(":user_serial", $user_serial); - $statement->bindValue(":user_status", $user_active); - $statement->bindValue(":user_changed", $this->getTimestamp()); - $statement->bindValue(":user_changer", $this->current_user_name); - - if (!$statement->execute()) { - error_log($statement->errorInfo()[2]); - } + (new MaintenanceService())->setUserActive(MaintenanceService::id($_POST['user_serial']??null),MaintenanceService::boolean($_POST['user_active']??null)); } // ==================================== @@ -573,14 +416,8 @@ class Users extends Base { // ==================================== public function getLoginActivity($userserial) { - - $SQL = "select view_journal.journal_timestamp_verbose, view_journal.journal_ip - from view_journal - where view_journal.journal_origin = '{$userserial}' - and view_journal.journal_entry like '{$userserial} %logged in%'"; - - return $this->getTable("loginactivity", $SQL); + $stmt=$this->connect()->prepare("SELECT journal_timestamp_verbose,journal_ip FROM view_journal WHERE journal_origin=? AND journal_entry LIKE ? ORDER BY journal_timestamp DESC,journal_serial DESC"); + $id=MaintenanceService::id($userserial);$stmt->execute([(string)$id,$id.' logged in%']); + return $this->getTableXML('loginactivity',$stmt); } } - -?> diff --git a/deploy/nginx.conf.example b/deploy/nginx.conf.example new file mode 100644 index 0000000..195b0b2 --- /dev/null +++ b/deploy/nginx.conf.example @@ -0,0 +1,28 @@ +# Substitute certificate paths, document root, and PHP socket before installation. +# This server terminates HTTPS directly. Forwarded headers are not trusted by default. +server { + listen 80; + server_name app.myhuntingclubroster.com; + return 301 https://app.myhuntingclubroster.com$request_uri; +} +server { + listen 443 ssl; + server_name app.myhuntingclubroster.com; + ssl_certificate /etc/ssl/hcr/fullchain.pem; + ssl_certificate_key /etc/ssl/hcr/privkey.pem; + root /srv/hcr/current; + index main.php; + autoindex off; + client_max_body_size 1m; + location ~ ^/(classes|vendor|xml|tables|views|migrations|bin|tests|nbproject|reports|deploy)(/|$) { return 404; } + location ~ /\. { return 404; } + location ~* \.(json|lock|xml|sql|md|ya?ml|toml|log|cnf|env|zip|bak)$ { return 404; } + location = /main.php { + include fastcgi_params; + fastcgi_param SCRIPT_FILENAME $document_root/main.php; + fastcgi_param HTTPS on; + fastcgi_pass unix:/run/php/hcr.sock; + } + location ~ \.php(?:/|$) { return 404; } + location / { try_files $uri $uri/ =404; } +} diff --git a/deploy/php-production.ini.example b/deploy/php-production.ini.example new file mode 100644 index 0000000..e4da1d0 --- /dev/null +++ b/deploy/php-production.ini.example @@ -0,0 +1,11 @@ +display_errors = Off +log_errors = On +expose_php = Off +session.use_strict_mode = 1 +session.use_only_cookies = 1 +session.cookie_httponly = 1 +session.cookie_samesite = Lax +session.cookie_secure = 1 +; Place logs and session storage outside the document root with restricted access. +; error_log = /var/log/hcr/php-errors.log +; session.save_path = /var/lib/hcr/sessions diff --git a/deploy/runtime-grants.sql.example b/deploy/runtime-grants.sql.example new file mode 100644 index 0000000..4fd80a0 --- /dev/null +++ b/deploy/runtime-grants.sql.example @@ -0,0 +1,24 @@ +-- Run as a DBA after provisioning the account with a strong externally managed +-- password and the correct application host restriction. Do not run from PHP. +-- Substitute the account/host/database to match the production deployment. +GRANT SELECT ON huntingclubroster.* TO 'hcr_runtime'@'app-host.example'; +GRANT INSERT, UPDATE, DELETE ON huntingclubroster.users TO 'hcr_runtime'@'app-host.example'; +GRANT INSERT, UPDATE, DELETE ON huntingclubroster.password_resets TO 'hcr_runtime'@'app-host.example'; +GRANT INSERT, UPDATE, DELETE ON huntingclubroster.auth_attempts TO 'hcr_runtime'@'app-host.example'; +GRANT INSERT, DELETE ON huntingclubroster.email_verifications TO 'hcr_runtime'@'app-host.example'; +GRANT INSERT, UPDATE, DELETE ON huntingclubroster.alerts TO 'hcr_runtime'@'app-host.example'; +GRANT INSERT, UPDATE, DELETE ON huntingclubroster.dropdowns TO 'hcr_runtime'@'app-host.example'; +GRANT INSERT, UPDATE, DELETE ON huntingclubroster.dropdowntypes TO 'hcr_runtime'@'app-host.example'; +GRANT INSERT, UPDATE, DELETE ON huntingclubroster.notes TO 'hcr_runtime'@'app-host.example'; +GRANT INSERT, UPDATE, DELETE ON huntingclubroster.popovers TO 'hcr_runtime'@'app-host.example'; +GRANT INSERT, UPDATE, DELETE ON huntingclubroster.statuses TO 'hcr_runtime'@'app-host.example'; +GRANT INSERT ON huntingclubroster.journal TO 'hcr_runtime'@'app-host.example'; +GRANT INSERT, UPDATE ON huntingclubroster.clubs TO 'hcr_runtime'@'app-host.example'; +GRANT INSERT, UPDATE ON huntingclubroster.club_memberships TO 'hcr_runtime'@'app-host.example'; +GRANT INSERT ON huntingclubroster.club_seasons TO 'hcr_runtime'@'app-host.example'; +GRANT INSERT ON huntingclubroster.club_dues TO 'hcr_runtime'@'app-host.example'; +GRANT INSERT ON huntingclubroster.club_payments TO 'hcr_runtime'@'app-host.example'; +GRANT INSERT ON huntingclubroster.club_due_adjustments TO 'hcr_runtime'@'app-host.example'; +GRANT INSERT ON huntingclubroster.club_payment_reversals TO 'hcr_runtime'@'app-host.example'; +-- No schema-changing privileges, journal UPDATE/DELETE, or financial UPDATE/DELETE. +-- Use separate credentials for migrations and backup/restore jobs. diff --git a/html/app-coming-soon.html b/html/app-coming-soon.html new file mode 100644 index 0000000..8296935 --- /dev/null +++ b/html/app-coming-soon.html @@ -0,0 +1,65 @@ + + + + + + + + + Application Coming Soon | MyHuntingClubRoster + + + +
+
+ + MyHuntingClubRoster +
+
+
+
+ +

Application coming soon

+

We’re getting ready
for your club.

+

The MyHuntingClubRoster application is still being prepared. We’re putting the finishing touches in place before opening the doors.

+

Please check back soon. Thanks for your patience.

+ + Visit our website + + +
+
+
app.myhuntingclubroster.comMyHuntingClubRoster · OneSource IT Solutions
+ + diff --git a/html/coming-soon.html b/html/coming-soon.html new file mode 100644 index 0000000..c866f88 --- /dev/null +++ b/html/coming-soon.html @@ -0,0 +1,89 @@ + + + + + + + + Coming Soon | MyHuntRoster + + + +
+
+
+ + MyHuntRoster +
+
+

Coming soon

+

A new season.
A fresh start.

+

Good things are taking shape behind the scenes. We’re getting MyHuntRoster ready for the next chapter of your hunting club.

+
+ +

We’re preparing for launch.Check back soon. We’ll see you out there.

+
+
+
MyHuntRoster   /   Built for the traditions you share.
+
+ +
+ + diff --git a/js/addAlert.js b/js/addAlert.js index 5c67e18..83eea96 100644 --- a/js/addAlert.js +++ b/js/addAlert.js @@ -94,22 +94,22 @@ $(document).ready(function () { // Show Calendar Buttons // --------------------- - $(".btnAlertStartDateCalendar").on("click", function (e) { + $(".btnAlertStartDateCalendar").on("click", async function (e) { e.preventDefault(); $("#alert_starts_date").focus().datepicker("show"); }); - $(".btnAlertExpiresDateCalendar").on("click", function (e) { + $(".btnAlertExpiresDateCalendar").on("click", async function (e) { e.preventDefault(); $("#alert_expires_date").focus().datepicker("show"); }); - $("#alert_starts_date").on("blur", function () { + $("#alert_starts_date").on("blur", async function () { $("#alert_starts_time").focus(); }); - $("#alert_expires_date").on("blur", function () { + $("#alert_expires_date").on("blur", async function () { $("#alert_expires_time").focus(); }); @@ -117,7 +117,7 @@ $(document).ready(function () { // Save Button // ----------- - $(".btnSave").on("click", function (e) { + $(".btnSave").on("click", async function (e) { e.preventDefault(); @@ -129,7 +129,7 @@ $(document).ready(function () { // Cancel Button // ------------- - $(".btnCancel").on("click", function () { + $(".btnCancel").on("click", async function () { $sessionStorage.action = $sessionStorage.addAlert || ""; @@ -143,7 +143,8 @@ $(document).ready(function () { // Validate Inputs // --------------- - $("#addAlert").submit(function (e) { + $("#addAlert").submit(async function (e) { + e.preventDefault(); var alert_title = $("#alert_title"), alert_starts_date = $("#alert_starts_date"), @@ -162,7 +163,7 @@ $(document).ready(function () { } - if ((!isBlank(alert_starts_date)) && (!isDate(alert_starts_date))) { + if ((!isBlank(alert_starts_date)) && (!await isDate(alert_starts_date))) { createInputError(alert_starts_date, "Date is invalid"); return false; } @@ -182,7 +183,7 @@ $(document).ready(function () { return false; } - if ((!isBlank(alert_expires_date)) && (!isDate(alert_expires_date))) { + if ((!isBlank(alert_expires_date)) && (!await isDate(alert_expires_date))) { createInputError(alert_expires_date, "Date is invalid"); return false; } diff --git a/js/addDropdown.js b/js/addDropdown.js index 965a912..dd237c9 100644 --- a/js/addDropdown.js +++ b/js/addDropdown.js @@ -12,7 +12,7 @@ $(document).ready(function () { // Save Button // ----------- - $(".btnSave").on("click", function (e) { + $(".btnSave").on("click", async function (e) { e.preventDefault(); $("#addDropdown").submit(); }); @@ -21,7 +21,7 @@ $(document).ready(function () { // Cancel Button. // -------------- - $(".btnCancel").on("click", function () { + $(".btnCancel").on("click", async function () { formSubmit({action: $sessionStorage.addDropdown}); }); @@ -29,7 +29,8 @@ $(document).ready(function () { // Validate Inputs // --------------- - $("#addDropdown").submit(function (e) { + $("#addDropdown").submit(async function (e) { + e.preventDefault(); var dropdowntype_serial = $("#dropdowntype_serial").val(), dropdown_value = $("#dropdown_value"); @@ -43,7 +44,7 @@ $(document).ready(function () { return false; } - if (formPost({action: "Dropdowns.dropdownExists", dropdowntype_serial: dropdowntype_serial, dropdown_serial: 0, dropdown_value: dropdown_value.val()}) === true) { + if (await formPost({action: "Dropdowns.dropdownExists", dropdowntype_serial: dropdowntype_serial, dropdown_serial: 0, dropdown_value: dropdown_value.val()}) === true) { createInputError(dropdown_value, "Value already exists"); return false; } diff --git a/js/addDropdowntype.js b/js/addDropdowntype.js index 637e6b8..9d1b61b 100644 --- a/js/addDropdowntype.js +++ b/js/addDropdowntype.js @@ -3,7 +3,7 @@ // Add Dropdowntype // ================ -$(document).ready(function() { +$(document).ready(function () { var $application = $("#APPLICATION_MNEMONIC").val(), $sessionStorage = JSON.parse(sessionStorage.getItem($application) || "{}"); @@ -12,7 +12,7 @@ $(document).ready(function() { // Save Button // ----------- - $(".btnSave").on("click", function(e) { + $(".btnSave").on("click", async function (e) { e.preventDefault(); $("#addDropdowntype").submit(); }); @@ -21,7 +21,7 @@ $(document).ready(function() { // Cancel Button. // -------------- - $(".btnCancel").on("click", function() { + $(".btnCancel").on("click", async function () { formSubmit({ action : $sessionStorage.addDropdowntype }); }); @@ -29,7 +29,8 @@ $(document).ready(function() { // Validate Inputs // --------------- - $("#addDropdowntype").submit( function(e) { + $("#addDropdowntype").submit( async function (e) { + e.preventDefault(); var dropdowntype_name = $("#dropdowntype_name"), dropdowntype_title = $("#dropdowntype_title"), @@ -48,7 +49,7 @@ $(document).ready(function() { return false; } - if (formPost({ action : "Dropdowns.dropdowntypeExists", dropdowntype_serial : 0, dropdowntype_name : dropdowntype_name.val() }) === true) { + if (await formPost({ action : "Dropdowns.dropdowntypeExists", dropdowntype_serial : 0, dropdowntype_name : dropdowntype_name.val() }) === true) { createInputError(dropdowntype_name, "Name already exists"); return false; } @@ -58,26 +59,16 @@ $(document).ready(function() { return false; } - if (formPost({ action : "Dropdowns.dropdowntypetitleExists", dropdowntype_serial : 0, dropdowntype_title : dropdowntype_title.val() }) === true) { + if (await formPost({ action : "Dropdowns.dropdowntypetitleExists", dropdowntype_serial : 0, dropdowntype_title : dropdowntype_title.val() }) === true) { createInputError(dropdowntype_title, "Title already exists"); return false; } - - if (isBlank(dropdowntype_table)) { - createInputError(dropdowntype_table, "Table is required"); - return false; - } - - if (isBlank(dropdowntype_column)) { - createInputError(dropdowntype_column, "Column is required"); - return false; - } e.preventDefault(); $.post("./", $(this).serialize()) - .done(function() { + .done(function () { $sessionStorage.action = $sessionStorage.addDropdowntype || ""; $sessionStorage.toast = "Dropdown Type was Added"; diff --git a/js/addNote.js b/js/addNote.js index 7cd0dcb..1c0e3dd 100644 --- a/js/addNote.js +++ b/js/addNote.js @@ -12,7 +12,7 @@ $(document).ready(function () { // Save Button // ----------- - $(".btnSave").on("click", function (e) { + $(".btnSave").on("click", async function (e) { e.preventDefault(); @@ -24,7 +24,7 @@ $(document).ready(function () { // Cancel Button. // -------------- - $(".btnCancel").on("click", function () { + $(".btnCancel").on("click", async function () { $sessionStorage.action = $sessionStorage.addNote || ""; @@ -38,7 +38,8 @@ $(document).ready(function () { // Validate Inputs // --------------- - $("#addNote").submit(function (e) { + $("#addNote").submit(async function (e) { + e.preventDefault(); var note_text = $("#note_text"); diff --git a/js/addPopover.js b/js/addPopover.js index 30b6542..b216d21 100644 --- a/js/addPopover.js +++ b/js/addPopover.js @@ -59,7 +59,7 @@ $(document).ready(function () { // Save Button // ----------- - $(".btnSave").on("click", function (e) { + $(".btnSave").on("click", async function (e) { e.preventDefault(); @@ -71,7 +71,7 @@ $(document).ready(function () { // Cancel Button. // -------------- - $(".btnCancel").on("click", function () { + $(".btnCancel").on("click", async function () { $sessionStorage.action = $sessionStorage.addPopover || ""; @@ -85,7 +85,8 @@ $(document).ready(function () { // Validate Inputs // --------------- - $("#addPopover").submit(function (e) { + $("#addPopover").submit(async function (e) { + e.preventDefault(); var popover_name = $("#popover_name"), popover_title = $("#popover_title"), @@ -101,7 +102,7 @@ $(document).ready(function () { return false; } - if (formPost({action: "Popovers.popoverExists", popover_serial: 0, popover_name: popover_name.val()}) === true) { + if (await formPost({action: "Popovers.popoverExists", popover_serial: 0, popover_name: popover_name.val()}) === true) { createInputError(popover_name, "Name already exists"); return false; } diff --git a/js/addReport.js b/js/addReport.js index 194368f..b4abded 100644 --- a/js/addReport.js +++ b/js/addReport.js @@ -12,7 +12,7 @@ $(document).ready(function () { // Save Button // ----------- - $(".btnSave").on("click", function (e) { + $(".btnSave").on("click", async function (e) { e.preventDefault(); @@ -24,7 +24,7 @@ $(document).ready(function () { // Cancel Button. // -------------- - $(".btnCancel").on("click", function () { + $(".btnCancel").on("click", async function () { $sessionStorage.action = $sessionStorage.addReport || ""; @@ -38,7 +38,8 @@ $(document).ready(function () { // Validate Inputs // --------------- - $("#addReport").submit(function (e) { + $("#addReport").submit(async function (e) { + e.preventDefault(); var report_name = $("#report_name"), report_class = $("#report_class"), @@ -59,7 +60,7 @@ $(document).ready(function () { return false; } - if (formPost({action: "Reports.reportExists", report_serial: 0, report_class: report_class.val()}) === true) { + if (await formPost({action: "Reports.reportExists", report_serial: 0, report_class: report_class.val()}) === true) { createInputError(report_class, "Class already exists"); return false; } diff --git a/js/addStatus.js b/js/addStatus.js index c76c772..78dfb21 100644 --- a/js/addStatus.js +++ b/js/addStatus.js @@ -3,7 +3,7 @@ // Add Status // ========== -$(document).ready(function() { +$(document).ready(function () { var $application = $("#APPLICATION_MNEMONIC").val(), $sessionStorage = JSON.parse(sessionStorage.getItem($application) || "{}"); @@ -12,7 +12,7 @@ $(document).ready(function() { // Save Button // ----------- - $(".btnSave").on("click", function(e) { + $(".btnSave").on("click", async function (e) { e.preventDefault(); $("#addStatus").submit(); }); @@ -21,7 +21,7 @@ $(document).ready(function() { // Cancel Button. // -------------- - $(".btnCancel").on("click", function() { + $(".btnCancel").on("click", async function () { $sessionStorage.action = $sessionStorage.addStatus || ""; @@ -35,7 +35,8 @@ $(document).ready(function() { // Validate Inputs // --------------- - $("#addStatus").submit( function(e) { + $("#addStatus").submit( async function (e) { + e.preventDefault(); var status_name = $("#status_name"), status_classes = $("#status_classes"); @@ -50,7 +51,7 @@ $(document).ready(function() { return false; } - if (formPost({ action : "Statuses.statusExists", status_serial : 0, status_name : status_name.val() }) === true) { + if (await formPost({ action : "Statuses.statusExists", status_serial : 0, status_name : status_name.val() }) === true) { createInputError(status_name, "Name already exists"); return false; } @@ -59,7 +60,7 @@ $(document).ready(function() { $.post("./", $(this).serialize()) - .done(function() { + .done(function () { $sessionStorage.action = $sessionStorage.addStatus || ""; $sessionStorage.toast = "Status was Added"; diff --git a/js/addUser.js b/js/addUser.js index 6b96d16..f49ee6d 100644 --- a/js/addUser.js +++ b/js/addUser.js @@ -27,11 +27,11 @@ $(document).ready(function () { // Get the User Information // ------------------------ - $("#user_name").on("change", function () { + $("#user_name").on("change", async function () { clearInputErrors(); - let user = formPost({action: "Users.getUser_AJAX", user_name: $(this).val()}); + let user = await formPost({action: "Users.getUser_AJAX", user_name: $(this).val()}); if (user.exists === true) { createInputError($(this), "User ID already exists"); @@ -44,7 +44,7 @@ $(document).ready(function () { // Save Button // ----------- - $(".btnSave").on("click", function (e) { + $(".btnSave").on("click", async function (e) { e.preventDefault(); $("#addUser").submit(); }); @@ -53,7 +53,7 @@ $(document).ready(function () { // Cancel Button. // -------------- - $(".btnCancel").on("click", function () { + $(".btnCancel").on("click", async function () { $sessionStorage.action = $sessionStorage.addUser || ""; @@ -66,7 +66,7 @@ $(document).ready(function () { // Toggle Show Password // -------------------- - $("#togglePassword").click(function () { + $("#togglePassword").click(async function () { var passwordField = $("#user_password"); var type = passwordField.attr("type") === "password" ? "text" : "password"; passwordField.attr("type", type); @@ -80,7 +80,8 @@ $(document).ready(function () { // Validate Inputs // --------------- - $("#addUser").submit(function (e) { + $("#addUser").submit(async function (e) { + e.preventDefault(); var user_name = $("#user_name"), user_first_name = $("#user_first_name"), @@ -96,7 +97,7 @@ $(document).ready(function () { return false; } - let user = formPost({action: "Users.getUser_AJAX", user_name: user_name.val()}); + let user = await formPost({action: "Users.getUser_AJAX", user_name: user_name.val()}); if (user.valid === false) { createInputError(user_name, "User Name is invalid"); @@ -109,7 +110,7 @@ $(document).ready(function () { } if (isBlank(user_first_name)) { - createInputError(user_first_name, "Client Name is required"); + createInputError(user_first_name, "First name is required"); return false; } @@ -118,6 +119,7 @@ $(document).ready(function () { return false; } + if (isBlank($('#user_last_name'))) { createInputError($('#user_last_name'),'Last name is required');return false; } if ($("option:selected", user_role).val() === "") { createInputError(user_role, "Role is required"); return false; @@ -127,7 +129,9 @@ $(document).ready(function () { e.preventDefault(); $.post("./", $(this).serialize()) - .done(function () { + .done(function (result) { + $sessionStorage.toast=result.warning || 'Account created and invitation sent.'; + sessionStorage.setItem($application,JSON.stringify($sessionStorage)); formSubmit({action: $sessionStorage.addUser}); }); diff --git a/js/autologout.js b/js/autologout.js index bd77962..9f2a6e4 100644 --- a/js/autologout.js +++ b/js/autologout.js @@ -17,10 +17,10 @@ function resetLogoutTimer() { startLogoutTimer(); } -function logoutUser() { +async function logoutUser() { // Redirect to a PHP logout script - formPost({action: "signout"}); + await formPost({action: "signout"}); window.location.reload(); } diff --git a/js/autosave.js b/js/autosave.js index de963f0..0f3d02d 100644 --- a/js/autosave.js +++ b/js/autosave.js @@ -1,84 +1,10 @@ - -// ===================== -// Auto Save and Restore -// ===================== - -var $sessionStorage = JSON.parse(sessionStorage.getItem("ATLHOUSINGREPORT") || "{}"); - -// ------------------- -// Save Changed Inputs -// ------------------- - -$(".autosave").on("change", function (e) { - - switch (e.target.type) { - - case "text" : - $sessionStorage[e.target.name] = $(this).val(); - break; - case "radio" : - $sessionStorage[e.target.name] = $(this).val(); - break; - case "checkbox" : - $sessionStorage[e.target.name] = $(this).prop("checked"); - break; - case "select-one" : - $sessionStorage[e.target.name] = $(this).val(); - break; - case "hidden" : - $sessionStorage[e.target.name] = $(this).val(); - break; - - default : - $sessionStorage[e.target.name] = $(this).val(); - break; - - } - - sessionStorage.setItem("HOMESTEAD", JSON.stringify($sessionStorage)); - +$(function(){ + const application=$('#APPLICATION_MNEMONIC').val();if(!application)return; + const key=application+':autosave:'+window.location.pathname; + let saved={};try{saved=JSON.parse(sessionStorage.getItem(key)||'{}');}catch(error){sessionStorage.removeItem(key);} + $('.autosave').filter(':not([type="password"]):not([type="hidden"])').each(function(){ + if(Object.prototype.hasOwnProperty.call(saved,this.name)){ + if(this.type==='checkbox')$(this).prop('checked',!!saved[this.name]);else $(this).val(saved[this.name]); + } + }).on('change',function(){saved[this.name]=this.type==='checkbox'?this.checked:$(this).val();sessionStorage.setItem(key,JSON.stringify(saved));}); }); - -// ---------------- -// Initalize Inputs -// ---------------- - -$.each($sessionStorage, function (name, value) { - - var $input = $(":input").filter("[name=" + name + "]"); - - if ($input.length > 0) { - - switch ($input.prop("type")) { - - case "text" : - $input.val(value); - break; - case "radio" : - $input.filter("[value=" + value + "]").prop("checked", true); - break; - case "checkbox" : - $input.prop("checked", value); - break; - case "select-one" : - $input.val(value); - break; - case "hidden" : - $input.val(value); - break; - - default : - $input.val(value); - break; - - } - - } - -}); - -// ------------------ -// Save preset Inputs -// ------------------ - -$("input[type=radio]:checked").trigger("change"); \ No newline at end of file diff --git a/js/base.js b/js/base.js index 1285659..ad16ef4 100644 --- a/js/base.js +++ b/js/base.js @@ -109,48 +109,16 @@ function isURL(object) { // AJAX Call to Get Zip Code Detail. // --------------------------------- -function getZipCodeDetail(zipcode) { - - var zipCodeDetail = null; - - $.ajax({ - url: "./", - type: "POST", - async: false, - data: {action: "get_zipcode_detail", - zip_code: zipcode}, - dataType: "json", - success: function (info) { - zipCodeDetail = info; - } - }); - - return zipCodeDetail; - +async function getZipCodeDetail(zipcode) { + return await formPost({action:'getZipcode',zip_code:zipcode}); } // ----------------------------- // AJAX Call to Validate a Date. // ----------------------------- -function isDate(date) { - - var valid = false; - - $.ajax({ - url: "./", - type: "POST", - async: false, - data: {action: "validateDate", - date: date.val()}, - dataType: "json", - success: function (result) { - valid = result; - } - }); - - return valid; - +async function isDate(date) { + return await formPost({action:'validateDate',date:date.val()}); } // --------------------------------------------- @@ -208,71 +176,44 @@ function trimString(string) { // ------------------- function formPost(inputs) { - - var response = ""; - - $.ajax({ - url: "./", - type: "POST", - async: false, - dataType: "json", - data: inputs, - success: function (results) { - response = results; - }, error: function (errorcode) { - console.log(errorcode); - } - - }); - - return response; - + return $.ajax({url:'./',type:'POST',dataType:'json',data:inputs}); } // -------------- // Submit a Form. // -------------- -//function formSubmit(inputs, target) { -// -// $('
').appendTo("body"); -// -// var form = $("#formSubmit"); -// -// if (target === "_blank") { -// form.prop("target", target); -// } -// -// for (var name in inputs) { -// form.append(''); -// } -// -// console.log($('#formSubmit').html()); -// -//// form.submit(); -// -//} - -// -------------- -// Submit a Form. -// -------------- - function formSubmit(inputs, target = "") { + const form=$("#formSubmit"); + form.prop('target',target); + form.find('input').not('[name="csrf_token"]').remove(); + Object.entries(inputs).forEach(([name,value])=>{ + if(name!=='csrf_token' && value!==undefined && value!==null)$('',{type:'hidden',name:name,value:String(value)}).appendTo(form); + }); + form.get(0).submit(); +} - var form = $("#formSubmit"); - - if (target === "_blank") { - form.prop("target", target); - } else { - form.prop("target", ""); - } - - for (var name in inputs) { - form.append(''); - } - - form.submit(); - +$(document).ajaxError(function(event,xhr){ + const message=(xhr.responseJSON && xhr.responseJSON.error) || (xhr.status===401?'Your session has expired. Reload the page to sign in.':'The request failed. Please try again.'); + showRequestMessage(message,'danger'); +}); +$(document).ajaxStart(function(){ + $('.btnSave,.btnConfirmDialogConfirm').filter(':enabled').addClass('request-busy').prop('disabled',true).attr('aria-busy','true'); +}).ajaxStop(function(){ + $('.request-busy').prop('disabled',false).removeClass('request-busy').removeAttr('aria-busy'); +}); +// jQuery reports these failures through ajaxError above. Stop the rejected event +// handler without also producing an unhandled promise error in the browser. +window.addEventListener('unhandledrejection',function(event){ + if(event.reason && typeof event.reason.status==='number')event.preventDefault(); +}); +function showRequestMessage(message,kind='info'){ + let box=$('#request-message'); + let target=$('.modal.show .modal-body').first(); + if(!target.length)target=$('.hr-workspace,main,body').first(); + if(!box.length)box=$('
',{id:'request-message',role:'alert',tabindex:'-1'}); + box.prependTo(target); + box.attr('class','alert alert-'+kind).text(message).trigger('focus'); } $(document).ready(function () { @@ -283,8 +224,15 @@ $(document).ready(function () { // Enable Tooltips and Popovers // ---------------------------- - $("[data-bs-toggle=tooltip]").tooltip({trigger: "hover", container: "body"}); - $("[data-bs-toggle=popover]").popover({trigger: "focus", container: "body"}); + document.querySelectorAll('[data-bs-toggle="tooltip"]').forEach(element=>{ + const title=element.getAttribute('data-bs-title')||element.getAttribute('title')||''; + if(title)bootstrap.Tooltip.getOrCreateInstance(element,{title:title,trigger:'hover',container:'body'}); + }); + document.querySelectorAll('[data-bs-toggle="popover"]').forEach(element=>{ + const title=element.getAttribute('data-bs-title')||element.getAttribute('title')||''; + const content=element.getAttribute('data-bs-content')||''; + if(title||content)bootstrap.Popover.getOrCreateInstance(element,{title:title,content:content,trigger:'focus',container:'body'}); + }); // ------------- // Display Toast @@ -294,7 +242,7 @@ $(document).ready(function () { if (toast !== "") { - $(".toast-body").html(toast); + $(".toast-body").text(toast); $("#toast-message").toast("show"); diff --git a/js/browser-support.js b/js/browser-support.js new file mode 100644 index 0000000..f47b243 --- /dev/null +++ b/js/browser-support.js @@ -0,0 +1,6 @@ +if (/msie\s|trident/i.test(window.navigator.userAgent)) { + window.location.href = 'html/unsupported.html'; +} +document.addEventListener('click', function (event) { + if (event.target.closest('[data-app-return]')) window.location.href = 'main.php'; +}); diff --git a/js/content.js b/js/content.js index 64f9d15..969aeef 100644 --- a/js/content.js +++ b/js/content.js @@ -11,81 +11,6 @@ $(document).ready(function () { // Navbar Links // ============ - // ------------ - // Manage Links - // ------------ - - $(".user-subscriptions").on("click", function () { - - $sessionStorage.action = "StripePayments.checkout"; - - sessionStorage.setItem($application, JSON.stringify($sessionStorage)); - - console.log($sessionStorage); - - formSubmit($sessionStorage); - - }); - - // ------- - // Support - // ------- - - $(".start-support-ticket").on("click", function () { - - $sessionStorage.action = "SupportTickets.startSupportTicket"; - - sessionStorage.setItem($application, JSON.stringify($sessionStorage)); - - console.log($sessionStorage); - - formSubmit($sessionStorage); - - }); - - $(".manage-permits").on("click", function () { - - $sessionStorage.action = "Permits.managePermits"; - $sessionStorage.pagination = "first"; - $sessionStorage.find_permit = ""; - $sessionStorage.permits_order_by = ""; - - sessionStorage.setItem($application, JSON.stringify($sessionStorage)); - - formSubmit($sessionStorage); - - }); - - // ------------- - // Consolidation - // ------------- - - $(".rdi-consolidation").on("click", function () { - - $sessionStorage.action = "Consolidation.consolidationSequence"; - $sessionStorage.step = "prompt"; - - sessionStorage.setItem($application, JSON.stringify($sessionStorage)); - - formSubmit($sessionStorage); - - }); - - // ----------------- - // Import Permit CSV - // ----------------- - - $(".import-permit-csv").on("click", function () { - - $sessionStorage.action = "Import.uploadCSVFile"; - $sessionStorage.step = "prompt"; - - sessionStorage.setItem($application, JSON.stringify($sessionStorage)); - - formSubmit($sessionStorage); - - }); - // ============= // Reports Links // ============= @@ -94,7 +19,7 @@ $(document).ready(function () { // Select Report // ------------- - $(".select-report").on("click", function () { + $(".select-report").on("click", async function () { $sessionStorage.action = "Reports.selectReport"; $sessionStorage.pagination = "first"; @@ -110,26 +35,11 @@ $(document).ready(function () { // Setup Links // =========== - // -------- - // Counties - // -------- - - $(".setup-counties").on("click", function () { - - $sessionStorage.action = "Counties.setupCounties"; - $sessionStorage.pagination = "first"; - $sessionStorage.find_county = ""; - - sessionStorage.setItem($application, JSON.stringify($sessionStorage)); - - formSubmit($sessionStorage); - - }); // ----- // Users // ----- - $(".setup-users").on("click", function () { + $(".setup-users").on("click", async function () { $sessionStorage.action = "Users.setupUsers"; $sessionStorage.pagination = "first"; @@ -141,27 +51,11 @@ $(document).ready(function () { }); - // ------------- - // Subscriptions - // ------------- - - $(".setup-subscriptions").on("click", function () { - - $sessionStorage.action = "Subscriptions.setupSubscriptions"; - $sessionStorage.pagination = "first"; - $sessionStorage.find_subscription = ""; - - sessionStorage.setItem($application, JSON.stringify($sessionStorage)); - - formSubmit($sessionStorage); - - }); - // --------- // Dropdowns // --------- - $(".setup-dropdowns").on("click", function () { + $(".setup-dropdowns").on("click", async function () { sessionStorage.removeItem($application); @@ -178,9 +72,9 @@ $(document).ready(function () { // Toggle Dark/Light Theme // ----------------------- - $(".toggle-theme").on("click", function () { + $(".toggle-theme").on("click", async function () { - formPost({action: "toggleTheme"}); + await formPost({action: "toggleTheme"}); if (document.documentElement.getAttribute("data-bs-theme") === "dark") { document.documentElement.setAttribute("data-bs-theme", "light"); @@ -194,9 +88,9 @@ $(document).ready(function () { // Sign out system // --------------- - $(".sign-out").on("click", function () { + $(".sign-out").on("click", async function () { - formPost({action: "signout"}); + await formPost({action: "signout"}); window.location.reload(); @@ -206,7 +100,7 @@ $(document).ready(function () { // Setup Dropdown Types // -------------------- - $(".setup-dropdowntypes").on("click", function () { + $(".setup-dropdowntypes").on("click", async function () { $sessionStorage.action = "Dropdowns.setupDropdowntypes"; $sessionStorage.pagination = "first"; @@ -221,7 +115,7 @@ $(document).ready(function () { // View Journal // ------------ - $(".view-journal").on("click", function () { + $(".view-journal").on("click", async function () { $sessionStorage.action = "Journal.viewJournal"; $sessionStorage.pagination = "first"; @@ -237,22 +131,13 @@ $(document).ready(function () { // View Support Tickets // -------------------- - $(".view-support-tickets").on("click", function () { - $sessionStorage.action = "SupportTickets.viewSupportTickets"; - $sessionStorage.pagination = "first"; - - sessionStorage.setItem($application, JSON.stringify($sessionStorage)); - - formSubmit($sessionStorage); - - }); // -------------- // Setup Popovers // -------------- - $(".setup-popovers").on("click", function () { + $(".setup-popovers").on("click", async function () { $sessionStorage.action = "Popovers.setupPopovers"; $sessionStorage.pagination = "first"; @@ -268,7 +153,7 @@ $(document).ready(function () { // Setup Alerts // -------------- - $(".setup-alerts").on("click", function () { + $(".setup-alerts").on("click", async function () { $sessionStorage.action = "Alerts.setupAlerts"; $sessionStorage.pagination = "first"; @@ -285,7 +170,7 @@ $(document).ready(function () { // Setup Reports // ------------- - $(".setup-reports").on("click", function () { + $(".setup-reports").on("click", async function () { $sessionStorage.action = "Reports.setupReports"; $sessionStorage.pagination = "first"; @@ -301,7 +186,7 @@ $(document).ready(function () { // Setup Statuses // -------------- - $(".setup-statuses").on("click", function () { + $(".setup-statuses").on("click", async function () { $sessionStorage.action = "Statuses.setupStatuses"; $sessionStorage.pagination = "first"; @@ -317,7 +202,7 @@ $(document).ready(function () { // Setup Statuses // -------------- - $(".run-developer-stub").on("click", function () { + $(".run-developer-stub").on("click", async function () { $sessionStorage.action = "testing"; diff --git a/js/editAlert.js b/js/editAlert.js index b088eaa..4e45d47 100644 --- a/js/editAlert.js +++ b/js/editAlert.js @@ -94,22 +94,22 @@ $(document).ready(function () { // Show Calendar Buttons // --------------------- - $(".btnAlertStartDateCalendar").on("click", function (e) { + $(".btnAlertStartDateCalendar").on("click", async function (e) { e.preventDefault(); $("#alert_starts_date").focus().datepicker("show"); }); - $(".btnAlertExpiresDateCalendar").on("click", function (e) { + $(".btnAlertExpiresDateCalendar").on("click", async function (e) { e.preventDefault(); $("#alert_expires_date").focus().datepicker("show"); }); - $("#alert_starts_date").on("blur", function () { + $("#alert_starts_date").on("blur", async function () { $("#alert_starts_time").focus(); }); - $("#alert_expires_date").on("blur", function () { + $("#alert_expires_date").on("blur", async function () { $("#alert_expires_time").focus(); }); @@ -117,7 +117,7 @@ $(document).ready(function () { // Save Button // ----------- - $(".btnSave").on("click", function (e) { + $(".btnSave").on("click", async function (e) { e.preventDefault(); @@ -129,7 +129,7 @@ $(document).ready(function () { // Cancel Button // ------------- - $(".btnCancel").on("click", function () { + $(".btnCancel").on("click", async function () { $sessionStorage.action = $sessionStorage.editAlert || ""; @@ -143,7 +143,8 @@ $(document).ready(function () { // Validate Inputs // --------------- - $("#editAlert").submit(function (e) { + $("#editAlert").submit(async function (e) { + e.preventDefault(); var alert_title = $("#alert_title"), alert_starts_date = $("#alert_starts_date"), @@ -162,7 +163,7 @@ $(document).ready(function () { } - if ((!isBlank(alert_starts_date)) && (!isDate(alert_starts_date))) { + if ((!isBlank(alert_starts_date)) && (!await isDate(alert_starts_date))) { createInputError(alert_starts_date, "Date is invalid"); return false; } @@ -182,7 +183,7 @@ $(document).ready(function () { return false; } - if ((!isBlank(alert_expires_date)) && (!isDate(alert_expires_date))) { + if ((!isBlank(alert_expires_date)) && (!await isDate(alert_expires_date))) { createInputError(alert_expires_date, "Date is invalid"); return false; } diff --git a/js/editDropdown.js b/js/editDropdown.js index 201eb20..25a1c2a 100644 --- a/js/editDropdown.js +++ b/js/editDropdown.js @@ -3,7 +3,7 @@ // Edit Dropdown // ============= -$(document).ready(function() { +$(document).ready(function () { var $application = $("#APPLICATION_MNEMONIC").val(), $sessionStorage = JSON.parse(sessionStorage.getItem($application) || "{}"); @@ -12,7 +12,7 @@ $(document).ready(function() { // Save Button // ----------- - $(".btnSave").on("click", function(e) { + $(".btnSave").on("click", async function (e) { e.preventDefault(); $("#editDropdown").submit(); }); @@ -21,7 +21,7 @@ $(document).ready(function() { // Cancel Button. // -------------- - $(".btnCancel").on("click", function() { + $(".btnCancel").on("click", async function () { formSubmit({ action : $sessionStorage.editDropdown }); }); @@ -29,9 +29,9 @@ $(document).ready(function() { // Delete Button // ------------- - $(".btnDelete").on("click", function() { + $(".btnDelete").on("click", async function () { - if (formPost({ action : "Dropdowns.dropdownActive", dropdown_serial : $sessionStorage.dropdown_serial }) === true) { + if (await formPost({ action : "Dropdowns.dropdownActive", dropdown_serial : $sessionStorage.dropdown_serial }) === true) { $("#continue-dialog").find(".modal-title").html("Cannot Delete Dropdown").end() .find(".modal-body").html("This Dropdown is in use and cannot be deleted.").end() @@ -48,11 +48,11 @@ $(document).ready(function() { }); - $("body").on("click", ".confirm-delete-dropdown .btnConfirmDialogConfirm", function() { + $("body").on("click", ".confirm-delete-dropdown .btnConfirmDialogConfirm", async function () { $.post("./", { action : "Dropdowns.deleteDropdown", dropdown_serial : $sessionStorage.dropdown_serial }) - .done(function() { + .done(function () { $sessionStorage.action = $sessionStorage.editDropdown || ""; $sessionStorage.toast = "Dropdown was Deleted"; @@ -69,7 +69,8 @@ $(document).ready(function() { // Validate Inputs // --------------- - $("#editDropdown").submit( function(e) { + $("#editDropdown").submit( async function (e) { + e.preventDefault(); var dropdowntype_serial = $("#dropdowntype_serial").val(), dropdown_serial = $("#dropdown_serial").val(), @@ -84,7 +85,7 @@ $(document).ready(function() { return false; } - if (formPost({ action : "Dropdowns.dropdownExists", dropdowntype_serial : dropdowntype_serial, dropdown_serial : dropdown_serial, dropdown_value : dropdown_value.val() }) === true) { + if (await formPost({ action : "Dropdowns.dropdownExists", dropdowntype_serial : dropdowntype_serial, dropdown_serial : dropdown_serial, dropdown_value : dropdown_value.val() }) === true) { createInputError(dropdown_value, "Value already exists"); return false; } @@ -93,7 +94,7 @@ $(document).ready(function() { $.post("./", $(this).serialize()) - .done(function() { + .done(function () { $sessionStorage.action = $sessionStorage.editDropdown || ""; $sessionStorage.toast = "Dropdown was Saved"; diff --git a/js/editDropdowntype.js b/js/editDropdowntype.js index 10693ef..88c573f 100644 --- a/js/editDropdowntype.js +++ b/js/editDropdowntype.js @@ -3,7 +3,7 @@ // Edit Dropdowntype // ================= -$(document).ready(function() { +$(document).ready(function () { var $application = $("#APPLICATION_MNEMONIC").val(), $sessionStorage = JSON.parse(sessionStorage.getItem($application) || "{}"); @@ -12,7 +12,7 @@ $(document).ready(function() { // Save Button // ----------- - $(".btnSave").on("click", function(e) { + $(".btnSave").on("click", async function (e) { e.preventDefault(); $("#editDropdowntype").submit(); }); @@ -21,7 +21,7 @@ $(document).ready(function() { // Cancel Button. // -------------- - $(".btnCancel").on("click", function() { + $(".btnCancel").on("click", async function () { formSubmit({ action : $sessionStorage.editDropdowntype }); }); @@ -29,9 +29,9 @@ $(document).ready(function() { // Delete Button // ------------- - $(".btnDelete").on("click", function() { + $(".btnDelete").on("click", async function () { - if (formPost({ action : "Dropdowns.dropdowntypeActive", dropdowntype_serial : $sessionStorage.dropdowntype_serial }) === true) { + if (await formPost({ action : "Dropdowns.dropdowntypeActive", dropdowntype_serial : $sessionStorage.dropdowntype_serial }) === true) { $("#continue-dialog").find(".modal-title").html("Cannot Delete Dropdown Type").end() .find(".modal-body").html("Dropdown Type is in use and cannot be deleted.").end() @@ -48,11 +48,11 @@ $(document).ready(function() { }); - $("body").on("click", ".confirm-delete-dropdowntype .btnConfirmDialogConfirm", function() { + $("body").on("click", ".confirm-delete-dropdowntype .btnConfirmDialogConfirm", async function () { $.post("./", { action : "Dropdowns.deleteDropdowntype", dropdowntype_serial : $sessionStorage.dropdowntype_serial }) - .done(function() { + .done(function () { $sessionStorage.action = $sessionStorage.editDropdowntype || ""; $sessionStorage.toast = "Dropdown Type was Deleted"; @@ -69,7 +69,8 @@ $(document).ready(function() { // Validate Inputs // --------------- - $("#editDropdowntype").submit( function(e) { + $("#editDropdowntype").submit( async function (e) { + e.preventDefault(); var dropdowntype_serial = $("#dropdowntype_serial"), dropdowntype_name = $("#dropdowntype_name"), @@ -89,7 +90,7 @@ $(document).ready(function() { return false; } - if (formPost({ action : "Dropdowns.dropdowntypeExists", dropdowntype_serial : dropdowntype_serial.val(), dropdowntype_name : dropdowntype_name.val() }) === true) { + if (await formPost({ action : "Dropdowns.dropdowntypeExists", dropdowntype_serial : dropdowntype_serial.val(), dropdowntype_name : dropdowntype_name.val() }) === true) { createInputError(dropdowntype_name, "Name already exists"); return false; } @@ -99,26 +100,16 @@ $(document).ready(function() { return false; } - if (formPost({ action : "Dropdowns.dropdowntypetitleExists", dropdowntype_serial : dropdowntype_serial.val(), dropdowntype_title : dropdowntype_title.val() }) === true) { + if (await formPost({ action : "Dropdowns.dropdowntypetitleExists", dropdowntype_serial : dropdowntype_serial.val(), dropdowntype_title : dropdowntype_title.val() }) === true) { createInputError(dropdowntype_title, "Title already exists"); return false; } - - if (isBlank(dropdowntype_table)) { - createInputError(dropdowntype_table, "Table is required"); - return false; - } - - if (isBlank(dropdowntype_column)) { - createInputError(dropdowntype_column, "Column is required"); - return false; - } e.preventDefault(); $.post("./", $(this).serialize()) - .done(function() { + .done(function () { $sessionStorage.action = $sessionStorage.editDropdowntype || ""; $sessionStorage.toast = "Dropdown Type was Saved"; diff --git a/js/editNote.js b/js/editNote.js index 1367b17..50b3c78 100644 --- a/js/editNote.js +++ b/js/editNote.js @@ -12,7 +12,7 @@ $(document).ready(function () { // Save Button // ----------- - $(".btnSave").on("click", function (e) { + $(".btnSave").on("click", async function (e) { e.preventDefault(); @@ -24,7 +24,7 @@ $(document).ready(function () { // Cancel Button. // -------------- - $(".btnCancel").on("click", function () { + $(".btnCancel").on("click", async function () { $sessionStorage.action = $sessionStorage.editNote || ""; @@ -38,7 +38,7 @@ $(document).ready(function () { // Delete Button // ------------- - $(".btnDelete").on("click", function () { + $(".btnDelete").on("click", async function () { $("#confirm-dialog").removeClass().addClass("modal confirm-delete-note") .find(".modal-title").html("Confirm Delete Note").end() @@ -47,7 +47,7 @@ $(document).ready(function () { }); - $("body").on("click", ".confirm-delete-note .btnConfirmDialogConfirm", function () { + $("body").on("click", ".confirm-delete-note .btnConfirmDialogConfirm", async function () { $.post("./", {action: "Notes.deleteNote", note_serial: $sessionStorage.note_serial}) .done(function () { @@ -61,7 +61,8 @@ $(document).ready(function () { // Validate Inputs // --------------- - $("#editNote").submit(function (e) { + $("#editNote").submit(async function (e) { + e.preventDefault(); var note_text = $("#note_text"); diff --git a/js/editPopover.js b/js/editPopover.js index bdd943b..6ecb615 100644 --- a/js/editPopover.js +++ b/js/editPopover.js @@ -59,7 +59,7 @@ $(document).ready(function () { // Save Button // ----------- - $(".btnSave").on("click", function (e) { + $(".btnSave").on("click", async function (e) { e.preventDefault(); @@ -71,7 +71,7 @@ $(document).ready(function () { // Cancel Button. // -------------- - $(".btnCancel").on("click", function () { + $(".btnCancel").on("click", async function () { $sessionStorage.action = $sessionStorage.editPopover; @@ -85,7 +85,7 @@ $(document).ready(function () { // Delete Button // ------------- - $(".btnDelete").on("click", function () { + $(".btnDelete").on("click", async function () { $("#confirm-dialog").removeClass().addClass("modal confirm-delete-popover") .find(".modal-title").html("Confirm Delete Popover").end() @@ -94,7 +94,7 @@ $(document).ready(function () { }); - $("body").on("click", ".confirm-delete-popover .btnConfirmDialogConfirm", function () { + $("body").on("click", ".confirm-delete-popover .btnConfirmDialogConfirm", async function () { $.post("./", {action: "Popovers.deletePopover", popover_serial: $sessionStorage.popover_serial}) @@ -114,7 +114,8 @@ $(document).ready(function () { // Validate Inputs // --------------- - $("#editPopover").submit(function (e) { + $("#editPopover").submit(async function (e) { + e.preventDefault(); var popover_serial = $("#popover_serial"), popover_name = $("#popover_name"), @@ -131,7 +132,7 @@ $(document).ready(function () { return false; } - if (formPost({action: "Popovers.popoverExists", popover_serial: popover_serial.val(), popover_name: popover_name.val()}) === true) { + if (await formPost({action: "Popovers.popoverExists", popover_serial: popover_serial.val(), popover_name: popover_name.val()}) === true) { createInputError(popover_name, "Name already exists"); return false; } diff --git a/js/editReport.js b/js/editReport.js index 38f555c..8a0eb0c 100644 --- a/js/editReport.js +++ b/js/editReport.js @@ -12,7 +12,7 @@ $(document).ready(function () { // Save Button // ----------- - $(".btnSave").on("click", function (e) { + $(".btnSave").on("click", async function (e) { e.preventDefault(); @@ -24,7 +24,7 @@ $(document).ready(function () { // Cancel Button. // -------------- - $(".btnCancel").on("click", function () { + $(".btnCancel").on("click", async function () { $sessionStorage.action = $sessionStorage.editReport || ""; @@ -38,7 +38,7 @@ $(document).ready(function () { // Delete Button // ------------- - $(".btnDelete").on("click", function () { + $(".btnDelete").on("click", async function () { $("#confirm-dialog").removeClass().addClass("modal confirm-delete-report") .find(".modal-title").html("Confirm Delete Report").end() @@ -47,7 +47,7 @@ $(document).ready(function () { }); - $("body").on("click", ".confirm-delete-report .btnConfirmDialogConfirm", function () { + $("body").on("click", ".confirm-delete-report .btnConfirmDialogConfirm", async function () { $.post("./", {action: "Reports.deleteReport", report_serial: $sessionStorage.report_serial}) @@ -68,7 +68,8 @@ $(document).ready(function () { // Validate Inputs // --------------- - $("#editReport").submit(function (e) { + $("#editReport").submit(async function (e) { + e.preventDefault(); var report_name = $("#report_name"), report_serial = $("#report_serial"), @@ -90,7 +91,7 @@ $(document).ready(function () { return false; } - if (formPost({action: "Reports.reportExists", report_serial: report_serial.val(), report_class: report_class.val()}) === true) { + if (await formPost({action: "Reports.reportExists", report_serial: report_serial.val(), report_class: report_class.val()}) === true) { createInputError(report_class, "Class already exists"); return false; } diff --git a/js/editStatus.js b/js/editStatus.js index 2fb7852..699e59d 100644 --- a/js/editStatus.js +++ b/js/editStatus.js @@ -3,7 +3,7 @@ // Edit Status // =========== -$(document).ready(function() { +$(document).ready(function () { var $application = $("#APPLICATION_MNEMONIC").val(), $sessionStorage = JSON.parse(sessionStorage.getItem($application) || "{}"); @@ -12,7 +12,7 @@ $(document).ready(function() { // Save Button // ----------- - $(".btnSave").on("click", function(e) { + $(".btnSave").on("click", async function (e) { e.preventDefault(); $("#editStatus").submit(); }); @@ -21,7 +21,7 @@ $(document).ready(function() { // Cancel Button. // -------------- - $(".btnCancel").on("click", function() { + $(".btnCancel").on("click", async function () { $sessionStorage.action = $sessionStorage.editStatus || ""; @@ -35,9 +35,9 @@ $(document).ready(function() { // Delete Button // ------------- - $(".btnDelete").on("click", function() { + $(".btnDelete").on("click", async function () { - if (formPost({ action : "Statuses.statusActive", status_serial : $sessionStorage.status_serial }) === true) { + if (await formPost({ action : "Statuses.statusActive", status_serial : $sessionStorage.status_serial }) === true) { $("#continue-dialog").find(".modal-title").html("Cannot Delete Status").end() .find(".modal-body").html("This Status is in use and cannot be deleted.").end() @@ -54,10 +54,10 @@ $(document).ready(function() { }); - $("body").on("click", ".confirm-delete-status .btnConfirmDialogConfirm", function() { + $("body").on("click", ".confirm-delete-status .btnConfirmDialogConfirm", async function () { $.post("./", { action : "Statuses.deleteStatus", status_serial : $sessionStorage.status_serial }) - .done(function() { + .done(function () { formSubmit({ action : $sessionStorage.deleteStatus }); }); @@ -67,7 +67,8 @@ $(document).ready(function() { // Validate Inputs // --------------- - $("#editStatus").submit( function(e) { + $("#editStatus").submit( async function (e) { + e.preventDefault(); var status_serial = $("#status_serial"), status_name = $("#status_name"), @@ -83,7 +84,7 @@ $(document).ready(function() { return false; } - if (formPost({ action : "Statuses.statusExists", status_serial : status_serial.val(), status_name : status_name.val() }) === true) { + if (await formPost({ action : "Statuses.statusExists", status_serial : status_serial.val(), status_name : status_name.val() }) === true) { createInputError(status_name, "Name already exists"); return false; } @@ -92,7 +93,7 @@ $(document).ready(function() { $.post("./", $(this).serialize()) - .done(function() { + .done(function () { $sessionStorage.action = $sessionStorage.editStatus || ""; $sessionStorage.toast = "Status was Saved"; diff --git a/js/editUser.js b/js/editUser.js index 8151731..f3b0a30 100644 --- a/js/editUser.js +++ b/js/editUser.js @@ -26,7 +26,7 @@ $(document).ready(function () { // Save Button // ----------- - $(".btnSave").on("click", function (e) { + $(".btnSave").on("click", async function (e) { e.preventDefault(); @@ -38,7 +38,7 @@ $(document).ready(function () { // Cancel Button. // -------------- - $(".btnCancel").on("click", function () { + $(".btnCancel").on("click", async function () { $sessionStorage.action = $sessionStorage.editUser || ""; @@ -52,9 +52,9 @@ $(document).ready(function () { // Delete Button // ------------- - $(".btnDelete").on("click", function () { + $(".btnDelete").on("click", async function () { - if (formPost({action: "Users.userActive", user_serial: $sessionStorage.user_serial}) === true) { + if (await formPost({action: "Users.userActive", user_serial: $sessionStorage.user_serial}) === true) { $("#continue-dialog").find(".modal-title").html("Cannot Delete User").end() .find(".modal-body").html("This User is Active and cannot be deleted.").end() @@ -71,7 +71,7 @@ $(document).ready(function () { }); - $("body").on("click", ".confirm-delete-user .btnConfirmDialogConfirm", function () { + $("body").on("click", ".confirm-delete-user .btnConfirmDialogConfirm", async function () { $.post("./", {action: "Users.deleteUser", user_serial: $sessionStorage.user_serial}) @@ -92,7 +92,8 @@ $(document).ready(function () { // Validate Inputs // --------------- - $("#editUser").submit(function (e) { + $("#editUser").submit(async function (e) { + e.preventDefault(); var user_name = $("#user_name"), user_email = $("#user_email"), @@ -101,7 +102,7 @@ $(document).ready(function () { clearInputErrors(); - user_name.val(titleCase(user_name.val())); + user_name.val(trimString(user_name.val())); user_email.val(trimString(user_email.val())); if (isBlank(user_name)) { @@ -115,10 +116,11 @@ $(document).ready(function () { } if (isBlank(user_first_name)) { - createInputError(user_first_name, "Client Name is required"); + createInputError(user_first_name, "First name is required"); return false; } + if (isBlank($('#user_last_name'))) { createInputError($('#user_last_name'),'Last name is required');return false; } if ($("option:selected", user_role).val() === "") { createInputError(user_role, "Role is required"); return false; diff --git a/js/jquery-3.2.0.min.js b/js/jquery-3.2.0.min.js deleted file mode 100644 index 2ec0d1d..0000000 --- a/js/jquery-3.2.0.min.js +++ /dev/null @@ -1,4 +0,0 @@ -/*! jQuery v3.2.0 | (c) JS Foundation and other contributors | jquery.org/license */ -!function(a,b){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){"use strict";var c=[],d=a.document,e=Object.getPrototypeOf,f=c.slice,g=c.concat,h=c.push,i=c.indexOf,j={},k=j.toString,l=j.hasOwnProperty,m=l.toString,n=m.call(Object),o={};function p(a,b){b=b||d;var c=b.createElement("script");c.text=a,b.head.appendChild(c).parentNode.removeChild(c)}var q="3.2.0",r=function(a,b){return new r.fn.init(a,b)},s=/^[\s\uFEFF\xA0]+|[\s\uFEFF\xA0]+$/g,t=/^-ms-/,u=/-([a-z])/g,v=function(a,b){return b.toUpperCase()};r.fn=r.prototype={jquery:q,constructor:r,length:0,toArray:function(){return f.call(this)},get:function(a){return null==a?f.call(this):a<0?this[a+this.length]:this[a]},pushStack:function(a){var b=r.merge(this.constructor(),a);return b.prevObject=this,b},each:function(a){return r.each(this,a)},map:function(a){return this.pushStack(r.map(this,function(b,c){return a.call(b,c,b)}))},slice:function(){return this.pushStack(f.apply(this,arguments))},first:function(){return this.eq(0)},last:function(){return this.eq(-1)},eq:function(a){var b=this.length,c=+a+(a<0?b:0);return this.pushStack(c>=0&&c0&&b-1 in a)}var x=function(a){var b,c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u="sizzle"+1*new Date,v=a.document,w=0,x=0,y=ha(),z=ha(),A=ha(),B=function(a,b){return a===b&&(l=!0),0},C={}.hasOwnProperty,D=[],E=D.pop,F=D.push,G=D.push,H=D.slice,I=function(a,b){for(var c=0,d=a.length;c+~]|"+K+")"+K+"*"),S=new RegExp("="+K+"*([^\\]'\"]*?)"+K+"*\\]","g"),T=new RegExp(N),U=new RegExp("^"+L+"$"),V={ID:new RegExp("^#("+L+")"),CLASS:new RegExp("^\\.("+L+")"),TAG:new RegExp("^("+L+"|[*])"),ATTR:new RegExp("^"+M),PSEUDO:new RegExp("^"+N),CHILD:new RegExp("^:(only|first|last|nth|nth-last)-(child|of-type)(?:\\("+K+"*(even|odd|(([+-]|)(\\d*)n|)"+K+"*(?:([+-]|)"+K+"*(\\d+)|))"+K+"*\\)|)","i"),bool:new RegExp("^(?:"+J+")$","i"),needsContext:new RegExp("^"+K+"*[>+~]|:(even|odd|eq|gt|lt|nth|first|last)(?:\\("+K+"*((?:-\\d)?\\d*)"+K+"*\\)|)(?=[^-]|$)","i")},W=/^(?:input|select|textarea|button)$/i,X=/^h\d$/i,Y=/^[^{]+\{\s*\[native \w/,Z=/^(?:#([\w-]+)|(\w+)|\.([\w-]+))$/,$=/[+~]/,_=new RegExp("\\\\([\\da-f]{1,6}"+K+"?|("+K+")|.)","ig"),aa=function(a,b,c){var d="0x"+b-65536;return d!==d||c?b:d<0?String.fromCharCode(d+65536):String.fromCharCode(d>>10|55296,1023&d|56320)},ba=/([\0-\x1f\x7f]|^-?\d)|^-$|[^\0-\x1f\x7f-\uFFFF\w-]/g,ca=function(a,b){return b?"\0"===a?"\ufffd":a.slice(0,-1)+"\\"+a.charCodeAt(a.length-1).toString(16)+" ":"\\"+a},da=function(){m()},ea=ta(function(a){return a.disabled===!0&&("form"in a||"label"in a)},{dir:"parentNode",next:"legend"});try{G.apply(D=H.call(v.childNodes),v.childNodes),D[v.childNodes.length].nodeType}catch(fa){G={apply:D.length?function(a,b){F.apply(a,H.call(b))}:function(a,b){var c=a.length,d=0;while(a[c++]=b[d++]);a.length=c-1}}}function ga(a,b,d,e){var f,h,j,k,l,o,r,s=b&&b.ownerDocument,w=b?b.nodeType:9;if(d=d||[],"string"!=typeof a||!a||1!==w&&9!==w&&11!==w)return d;if(!e&&((b?b.ownerDocument||b:v)!==n&&m(b),b=b||n,p)){if(11!==w&&(l=Z.exec(a)))if(f=l[1]){if(9===w){if(!(j=b.getElementById(f)))return d;if(j.id===f)return d.push(j),d}else if(s&&(j=s.getElementById(f))&&t(b,j)&&j.id===f)return d.push(j),d}else{if(l[2])return G.apply(d,b.getElementsByTagName(a)),d;if((f=l[3])&&c.getElementsByClassName&&b.getElementsByClassName)return G.apply(d,b.getElementsByClassName(f)),d}if(c.qsa&&!A[a+" "]&&(!q||!q.test(a))){if(1!==w)s=b,r=a;else if("object"!==b.nodeName.toLowerCase()){(k=b.getAttribute("id"))?k=k.replace(ba,ca):b.setAttribute("id",k=u),o=g(a),h=o.length;while(h--)o[h]="#"+k+" "+sa(o[h]);r=o.join(","),s=$.test(a)&&qa(b.parentNode)||b}if(r)try{return G.apply(d,s.querySelectorAll(r)),d}catch(x){}finally{k===u&&b.removeAttribute("id")}}}return i(a.replace(P,"$1"),b,d,e)}function ha(){var a=[];function b(c,e){return a.push(c+" ")>d.cacheLength&&delete b[a.shift()],b[c+" "]=e}return b}function ia(a){return a[u]=!0,a}function ja(a){var b=n.createElement("fieldset");try{return!!a(b)}catch(c){return!1}finally{b.parentNode&&b.parentNode.removeChild(b),b=null}}function ka(a,b){var c=a.split("|"),e=c.length;while(e--)d.attrHandle[c[e]]=b}function la(a,b){var c=b&&a,d=c&&1===a.nodeType&&1===b.nodeType&&a.sourceIndex-b.sourceIndex;if(d)return d;if(c)while(c=c.nextSibling)if(c===b)return-1;return a?1:-1}function ma(a){return function(b){var c=b.nodeName.toLowerCase();return"input"===c&&b.type===a}}function na(a){return function(b){var c=b.nodeName.toLowerCase();return("input"===c||"button"===c)&&b.type===a}}function oa(a){return function(b){return"form"in b?b.parentNode&&b.disabled===!1?"label"in b?"label"in b.parentNode?b.parentNode.disabled===a:b.disabled===a:b.isDisabled===a||b.isDisabled!==!a&&ea(b)===a:b.disabled===a:"label"in b&&b.disabled===a}}function pa(a){return ia(function(b){return b=+b,ia(function(c,d){var e,f=a([],c.length,b),g=f.length;while(g--)c[e=f[g]]&&(c[e]=!(d[e]=c[e]))})})}function qa(a){return a&&"undefined"!=typeof a.getElementsByTagName&&a}c=ga.support={},f=ga.isXML=function(a){var b=a&&(a.ownerDocument||a).documentElement;return!!b&&"HTML"!==b.nodeName},m=ga.setDocument=function(a){var b,e,g=a?a.ownerDocument||a:v;return g!==n&&9===g.nodeType&&g.documentElement?(n=g,o=n.documentElement,p=!f(n),v!==n&&(e=n.defaultView)&&e.top!==e&&(e.addEventListener?e.addEventListener("unload",da,!1):e.attachEvent&&e.attachEvent("onunload",da)),c.attributes=ja(function(a){return a.className="i",!a.getAttribute("className")}),c.getElementsByTagName=ja(function(a){return a.appendChild(n.createComment("")),!a.getElementsByTagName("*").length}),c.getElementsByClassName=Y.test(n.getElementsByClassName),c.getById=ja(function(a){return o.appendChild(a).id=u,!n.getElementsByName||!n.getElementsByName(u).length}),c.getById?(d.filter.ID=function(a){var b=a.replace(_,aa);return function(a){return a.getAttribute("id")===b}},d.find.ID=function(a,b){if("undefined"!=typeof b.getElementById&&p){var c=b.getElementById(a);return c?[c]:[]}}):(d.filter.ID=function(a){var b=a.replace(_,aa);return function(a){var c="undefined"!=typeof a.getAttributeNode&&a.getAttributeNode("id");return c&&c.value===b}},d.find.ID=function(a,b){if("undefined"!=typeof b.getElementById&&p){var c,d,e,f=b.getElementById(a);if(f){if(c=f.getAttributeNode("id"),c&&c.value===a)return[f];e=b.getElementsByName(a),d=0;while(f=e[d++])if(c=f.getAttributeNode("id"),c&&c.value===a)return[f]}return[]}}),d.find.TAG=c.getElementsByTagName?function(a,b){return"undefined"!=typeof b.getElementsByTagName?b.getElementsByTagName(a):c.qsa?b.querySelectorAll(a):void 0}:function(a,b){var c,d=[],e=0,f=b.getElementsByTagName(a);if("*"===a){while(c=f[e++])1===c.nodeType&&d.push(c);return d}return f},d.find.CLASS=c.getElementsByClassName&&function(a,b){if("undefined"!=typeof b.getElementsByClassName&&p)return b.getElementsByClassName(a)},r=[],q=[],(c.qsa=Y.test(n.querySelectorAll))&&(ja(function(a){o.appendChild(a).innerHTML="",a.querySelectorAll("[msallowcapture^='']").length&&q.push("[*^$]="+K+"*(?:''|\"\")"),a.querySelectorAll("[selected]").length||q.push("\\["+K+"*(?:value|"+J+")"),a.querySelectorAll("[id~="+u+"-]").length||q.push("~="),a.querySelectorAll(":checked").length||q.push(":checked"),a.querySelectorAll("a#"+u+"+*").length||q.push(".#.+[+~]")}),ja(function(a){a.innerHTML="";var b=n.createElement("input");b.setAttribute("type","hidden"),a.appendChild(b).setAttribute("name","D"),a.querySelectorAll("[name=d]").length&&q.push("name"+K+"*[*^$|!~]?="),2!==a.querySelectorAll(":enabled").length&&q.push(":enabled",":disabled"),o.appendChild(a).disabled=!0,2!==a.querySelectorAll(":disabled").length&&q.push(":enabled",":disabled"),a.querySelectorAll("*,:x"),q.push(",.*:")})),(c.matchesSelector=Y.test(s=o.matches||o.webkitMatchesSelector||o.mozMatchesSelector||o.oMatchesSelector||o.msMatchesSelector))&&ja(function(a){c.disconnectedMatch=s.call(a,"*"),s.call(a,"[s!='']:x"),r.push("!=",N)}),q=q.length&&new RegExp(q.join("|")),r=r.length&&new RegExp(r.join("|")),b=Y.test(o.compareDocumentPosition),t=b||Y.test(o.contains)?function(a,b){var c=9===a.nodeType?a.documentElement:a,d=b&&b.parentNode;return a===d||!(!d||1!==d.nodeType||!(c.contains?c.contains(d):a.compareDocumentPosition&&16&a.compareDocumentPosition(d)))}:function(a,b){if(b)while(b=b.parentNode)if(b===a)return!0;return!1},B=b?function(a,b){if(a===b)return l=!0,0;var d=!a.compareDocumentPosition-!b.compareDocumentPosition;return d?d:(d=(a.ownerDocument||a)===(b.ownerDocument||b)?a.compareDocumentPosition(b):1,1&d||!c.sortDetached&&b.compareDocumentPosition(a)===d?a===n||a.ownerDocument===v&&t(v,a)?-1:b===n||b.ownerDocument===v&&t(v,b)?1:k?I(k,a)-I(k,b):0:4&d?-1:1)}:function(a,b){if(a===b)return l=!0,0;var c,d=0,e=a.parentNode,f=b.parentNode,g=[a],h=[b];if(!e||!f)return a===n?-1:b===n?1:e?-1:f?1:k?I(k,a)-I(k,b):0;if(e===f)return la(a,b);c=a;while(c=c.parentNode)g.unshift(c);c=b;while(c=c.parentNode)h.unshift(c);while(g[d]===h[d])d++;return d?la(g[d],h[d]):g[d]===v?-1:h[d]===v?1:0},n):n},ga.matches=function(a,b){return ga(a,null,null,b)},ga.matchesSelector=function(a,b){if((a.ownerDocument||a)!==n&&m(a),b=b.replace(S,"='$1']"),c.matchesSelector&&p&&!A[b+" "]&&(!r||!r.test(b))&&(!q||!q.test(b)))try{var d=s.call(a,b);if(d||c.disconnectedMatch||a.document&&11!==a.document.nodeType)return d}catch(e){}return ga(b,n,null,[a]).length>0},ga.contains=function(a,b){return(a.ownerDocument||a)!==n&&m(a),t(a,b)},ga.attr=function(a,b){(a.ownerDocument||a)!==n&&m(a);var e=d.attrHandle[b.toLowerCase()],f=e&&C.call(d.attrHandle,b.toLowerCase())?e(a,b,!p):void 0;return void 0!==f?f:c.attributes||!p?a.getAttribute(b):(f=a.getAttributeNode(b))&&f.specified?f.value:null},ga.escape=function(a){return(a+"").replace(ba,ca)},ga.error=function(a){throw new Error("Syntax error, unrecognized expression: "+a)},ga.uniqueSort=function(a){var b,d=[],e=0,f=0;if(l=!c.detectDuplicates,k=!c.sortStable&&a.slice(0),a.sort(B),l){while(b=a[f++])b===a[f]&&(e=d.push(f));while(e--)a.splice(d[e],1)}return k=null,a},e=ga.getText=function(a){var b,c="",d=0,f=a.nodeType;if(f){if(1===f||9===f||11===f){if("string"==typeof a.textContent)return a.textContent;for(a=a.firstChild;a;a=a.nextSibling)c+=e(a)}else if(3===f||4===f)return a.nodeValue}else while(b=a[d++])c+=e(b);return c},d=ga.selectors={cacheLength:50,createPseudo:ia,match:V,attrHandle:{},find:{},relative:{">":{dir:"parentNode",first:!0}," ":{dir:"parentNode"},"+":{dir:"previousSibling",first:!0},"~":{dir:"previousSibling"}},preFilter:{ATTR:function(a){return a[1]=a[1].replace(_,aa),a[3]=(a[3]||a[4]||a[5]||"").replace(_,aa),"~="===a[2]&&(a[3]=" "+a[3]+" "),a.slice(0,4)},CHILD:function(a){return a[1]=a[1].toLowerCase(),"nth"===a[1].slice(0,3)?(a[3]||ga.error(a[0]),a[4]=+(a[4]?a[5]+(a[6]||1):2*("even"===a[3]||"odd"===a[3])),a[5]=+(a[7]+a[8]||"odd"===a[3])):a[3]&&ga.error(a[0]),a},PSEUDO:function(a){var b,c=!a[6]&&a[2];return V.CHILD.test(a[0])?null:(a[3]?a[2]=a[4]||a[5]||"":c&&T.test(c)&&(b=g(c,!0))&&(b=c.indexOf(")",c.length-b)-c.length)&&(a[0]=a[0].slice(0,b),a[2]=c.slice(0,b)),a.slice(0,3))}},filter:{TAG:function(a){var b=a.replace(_,aa).toLowerCase();return"*"===a?function(){return!0}:function(a){return a.nodeName&&a.nodeName.toLowerCase()===b}},CLASS:function(a){var b=y[a+" "];return b||(b=new RegExp("(^|"+K+")"+a+"("+K+"|$)"))&&y(a,function(a){return b.test("string"==typeof a.className&&a.className||"undefined"!=typeof a.getAttribute&&a.getAttribute("class")||"")})},ATTR:function(a,b,c){return function(d){var e=ga.attr(d,a);return null==e?"!="===b:!b||(e+="","="===b?e===c:"!="===b?e!==c:"^="===b?c&&0===e.indexOf(c):"*="===b?c&&e.indexOf(c)>-1:"$="===b?c&&e.slice(-c.length)===c:"~="===b?(" "+e.replace(O," ")+" ").indexOf(c)>-1:"|="===b&&(e===c||e.slice(0,c.length+1)===c+"-"))}},CHILD:function(a,b,c,d,e){var f="nth"!==a.slice(0,3),g="last"!==a.slice(-4),h="of-type"===b;return 1===d&&0===e?function(a){return!!a.parentNode}:function(b,c,i){var j,k,l,m,n,o,p=f!==g?"nextSibling":"previousSibling",q=b.parentNode,r=h&&b.nodeName.toLowerCase(),s=!i&&!h,t=!1;if(q){if(f){while(p){m=b;while(m=m[p])if(h?m.nodeName.toLowerCase()===r:1===m.nodeType)return!1;o=p="only"===a&&!o&&"nextSibling"}return!0}if(o=[g?q.firstChild:q.lastChild],g&&s){m=q,l=m[u]||(m[u]={}),k=l[m.uniqueID]||(l[m.uniqueID]={}),j=k[a]||[],n=j[0]===w&&j[1],t=n&&j[2],m=n&&q.childNodes[n];while(m=++n&&m&&m[p]||(t=n=0)||o.pop())if(1===m.nodeType&&++t&&m===b){k[a]=[w,n,t];break}}else if(s&&(m=b,l=m[u]||(m[u]={}),k=l[m.uniqueID]||(l[m.uniqueID]={}),j=k[a]||[],n=j[0]===w&&j[1],t=n),t===!1)while(m=++n&&m&&m[p]||(t=n=0)||o.pop())if((h?m.nodeName.toLowerCase()===r:1===m.nodeType)&&++t&&(s&&(l=m[u]||(m[u]={}),k=l[m.uniqueID]||(l[m.uniqueID]={}),k[a]=[w,t]),m===b))break;return t-=e,t===d||t%d===0&&t/d>=0}}},PSEUDO:function(a,b){var c,e=d.pseudos[a]||d.setFilters[a.toLowerCase()]||ga.error("unsupported pseudo: "+a);return e[u]?e(b):e.length>1?(c=[a,a,"",b],d.setFilters.hasOwnProperty(a.toLowerCase())?ia(function(a,c){var d,f=e(a,b),g=f.length;while(g--)d=I(a,f[g]),a[d]=!(c[d]=f[g])}):function(a){return e(a,0,c)}):e}},pseudos:{not:ia(function(a){var b=[],c=[],d=h(a.replace(P,"$1"));return d[u]?ia(function(a,b,c,e){var f,g=d(a,null,e,[]),h=a.length;while(h--)(f=g[h])&&(a[h]=!(b[h]=f))}):function(a,e,f){return b[0]=a,d(b,null,f,c),b[0]=null,!c.pop()}}),has:ia(function(a){return function(b){return ga(a,b).length>0}}),contains:ia(function(a){return a=a.replace(_,aa),function(b){return(b.textContent||b.innerText||e(b)).indexOf(a)>-1}}),lang:ia(function(a){return U.test(a||"")||ga.error("unsupported lang: "+a),a=a.replace(_,aa).toLowerCase(),function(b){var c;do if(c=p?b.lang:b.getAttribute("xml:lang")||b.getAttribute("lang"))return c=c.toLowerCase(),c===a||0===c.indexOf(a+"-");while((b=b.parentNode)&&1===b.nodeType);return!1}}),target:function(b){var c=a.location&&a.location.hash;return c&&c.slice(1)===b.id},root:function(a){return a===o},focus:function(a){return a===n.activeElement&&(!n.hasFocus||n.hasFocus())&&!!(a.type||a.href||~a.tabIndex)},enabled:oa(!1),disabled:oa(!0),checked:function(a){var b=a.nodeName.toLowerCase();return"input"===b&&!!a.checked||"option"===b&&!!a.selected},selected:function(a){return a.parentNode&&a.parentNode.selectedIndex,a.selected===!0},empty:function(a){for(a=a.firstChild;a;a=a.nextSibling)if(a.nodeType<6)return!1;return!0},parent:function(a){return!d.pseudos.empty(a)},header:function(a){return X.test(a.nodeName)},input:function(a){return W.test(a.nodeName)},button:function(a){var b=a.nodeName.toLowerCase();return"input"===b&&"button"===a.type||"button"===b},text:function(a){var b;return"input"===a.nodeName.toLowerCase()&&"text"===a.type&&(null==(b=a.getAttribute("type"))||"text"===b.toLowerCase())},first:pa(function(){return[0]}),last:pa(function(a,b){return[b-1]}),eq:pa(function(a,b,c){return[c<0?c+b:c]}),even:pa(function(a,b){for(var c=0;c=0;)a.push(d);return a}),gt:pa(function(a,b,c){for(var d=c<0?c+b:c;++d1?function(b,c,d){var e=a.length;while(e--)if(!a[e](b,c,d))return!1;return!0}:a[0]}function va(a,b,c){for(var d=0,e=b.length;d-1&&(f[j]=!(g[j]=l))}}else r=wa(r===g?r.splice(o,r.length):r),e?e(null,g,r,i):G.apply(g,r)})}function ya(a){for(var b,c,e,f=a.length,g=d.relative[a[0].type],h=g||d.relative[" "],i=g?1:0,k=ta(function(a){return a===b},h,!0),l=ta(function(a){return I(b,a)>-1},h,!0),m=[function(a,c,d){var e=!g&&(d||c!==j)||((b=c).nodeType?k(a,c,d):l(a,c,d));return b=null,e}];i1&&ua(m),i>1&&sa(a.slice(0,i-1).concat({value:" "===a[i-2].type?"*":""})).replace(P,"$1"),c,i0,e=a.length>0,f=function(f,g,h,i,k){var l,o,q,r=0,s="0",t=f&&[],u=[],v=j,x=f||e&&d.find.TAG("*",k),y=w+=null==v?1:Math.random()||.1,z=x.length;for(k&&(j=g===n||g||k);s!==z&&null!=(l=x[s]);s++){if(e&&l){o=0,g||l.ownerDocument===n||(m(l),h=!p);while(q=a[o++])if(q(l,g||n,h)){i.push(l);break}k&&(w=y)}c&&((l=!q&&l)&&r--,f&&t.push(l))}if(r+=s,c&&s!==r){o=0;while(q=b[o++])q(t,u,g,h);if(f){if(r>0)while(s--)t[s]||u[s]||(u[s]=E.call(i));u=wa(u)}G.apply(i,u),k&&!f&&u.length>0&&r+b.length>1&&ga.uniqueSort(i)}return k&&(w=y,j=v),t};return c?ia(f):f}return h=ga.compile=function(a,b){var c,d=[],e=[],f=A[a+" "];if(!f){b||(b=g(a)),c=b.length;while(c--)f=ya(b[c]),f[u]?d.push(f):e.push(f);f=A(a,za(e,d)),f.selector=a}return f},i=ga.select=function(a,b,c,e){var f,i,j,k,l,m="function"==typeof a&&a,n=!e&&g(a=m.selector||a);if(c=c||[],1===n.length){if(i=n[0]=n[0].slice(0),i.length>2&&"ID"===(j=i[0]).type&&9===b.nodeType&&p&&d.relative[i[1].type]){if(b=(d.find.ID(j.matches[0].replace(_,aa),b)||[])[0],!b)return c;m&&(b=b.parentNode),a=a.slice(i.shift().value.length)}f=V.needsContext.test(a)?0:i.length;while(f--){if(j=i[f],d.relative[k=j.type])break;if((l=d.find[k])&&(e=l(j.matches[0].replace(_,aa),$.test(i[0].type)&&qa(b.parentNode)||b))){if(i.splice(f,1),a=e.length&&sa(i),!a)return G.apply(c,e),c;break}}}return(m||h(a,n))(e,b,!p,c,!b||$.test(a)&&qa(b.parentNode)||b),c},c.sortStable=u.split("").sort(B).join("")===u,c.detectDuplicates=!!l,m(),c.sortDetached=ja(function(a){return 1&a.compareDocumentPosition(n.createElement("fieldset"))}),ja(function(a){return a.innerHTML="","#"===a.firstChild.getAttribute("href")})||ka("type|href|height|width",function(a,b,c){if(!c)return a.getAttribute(b,"type"===b.toLowerCase()?1:2)}),c.attributes&&ja(function(a){return a.innerHTML="",a.firstChild.setAttribute("value",""),""===a.firstChild.getAttribute("value")})||ka("value",function(a,b,c){if(!c&&"input"===a.nodeName.toLowerCase())return a.defaultValue}),ja(function(a){return null==a.getAttribute("disabled")})||ka(J,function(a,b,c){var d;if(!c)return a[b]===!0?b.toLowerCase():(d=a.getAttributeNode(b))&&d.specified?d.value:null}),ga}(a);r.find=x,r.expr=x.selectors,r.expr[":"]=r.expr.pseudos,r.uniqueSort=r.unique=x.uniqueSort,r.text=x.getText,r.isXMLDoc=x.isXML,r.contains=x.contains,r.escapeSelector=x.escape;var y=function(a,b,c){var d=[],e=void 0!==c;while((a=a[b])&&9!==a.nodeType)if(1===a.nodeType){if(e&&r(a).is(c))break;d.push(a)}return d},z=function(a,b){for(var c=[];a;a=a.nextSibling)1===a.nodeType&&a!==b&&c.push(a);return c},A=r.expr.match.needsContext;function B(a,b){return a.nodeName&&a.nodeName.toLowerCase()===b.toLowerCase()}var C=/^<([a-z][^\/\0>:\x20\t\r\n\f]*)[\x20\t\r\n\f]*\/?>(?:<\/\1>|)$/i,D=/^.[^:#\[\.,]*$/;function E(a,b,c){return r.isFunction(b)?r.grep(a,function(a,d){return!!b.call(a,d,a)!==c}):b.nodeType?r.grep(a,function(a){return a===b!==c}):"string"!=typeof b?r.grep(a,function(a){return i.call(b,a)>-1!==c}):D.test(b)?r.filter(b,a,c):(b=r.filter(b,a),r.grep(a,function(a){return i.call(b,a)>-1!==c&&1===a.nodeType}))}r.filter=function(a,b,c){var d=b[0];return c&&(a=":not("+a+")"),1===b.length&&1===d.nodeType?r.find.matchesSelector(d,a)?[d]:[]:r.find.matches(a,r.grep(b,function(a){return 1===a.nodeType}))},r.fn.extend({find:function(a){var b,c,d=this.length,e=this;if("string"!=typeof a)return this.pushStack(r(a).filter(function(){for(b=0;b1?r.uniqueSort(c):c},filter:function(a){return this.pushStack(E(this,a||[],!1))},not:function(a){return this.pushStack(E(this,a||[],!0))},is:function(a){return!!E(this,"string"==typeof a&&A.test(a)?r(a):a||[],!1).length}});var F,G=/^(?:\s*(<[\w\W]+>)[^>]*|#([\w-]+))$/,H=r.fn.init=function(a,b,c){var e,f;if(!a)return this;if(c=c||F,"string"==typeof a){if(e="<"===a[0]&&">"===a[a.length-1]&&a.length>=3?[null,a,null]:G.exec(a),!e||!e[1]&&b)return!b||b.jquery?(b||c).find(a):this.constructor(b).find(a);if(e[1]){if(b=b instanceof r?b[0]:b,r.merge(this,r.parseHTML(e[1],b&&b.nodeType?b.ownerDocument||b:d,!0)),C.test(e[1])&&r.isPlainObject(b))for(e in b)r.isFunction(this[e])?this[e](b[e]):this.attr(e,b[e]);return this}return f=d.getElementById(e[2]),f&&(this[0]=f,this.length=1),this}return a.nodeType?(this[0]=a,this.length=1,this):r.isFunction(a)?void 0!==c.ready?c.ready(a):a(r):r.makeArray(a,this)};H.prototype=r.fn,F=r(d);var I=/^(?:parents|prev(?:Until|All))/,J={children:!0,contents:!0,next:!0,prev:!0};r.fn.extend({has:function(a){var b=r(a,this),c=b.length;return this.filter(function(){for(var a=0;a-1:1===c.nodeType&&r.find.matchesSelector(c,a))){f.push(c);break}return this.pushStack(f.length>1?r.uniqueSort(f):f)},index:function(a){return a?"string"==typeof a?i.call(r(a),this[0]):i.call(this,a.jquery?a[0]:a):this[0]&&this[0].parentNode?this.first().prevAll().length:-1},add:function(a,b){return this.pushStack(r.uniqueSort(r.merge(this.get(),r(a,b))))},addBack:function(a){return this.add(null==a?this.prevObject:this.prevObject.filter(a))}});function K(a,b){while((a=a[b])&&1!==a.nodeType);return a}r.each({parent:function(a){var b=a.parentNode;return b&&11!==b.nodeType?b:null},parents:function(a){return y(a,"parentNode")},parentsUntil:function(a,b,c){return y(a,"parentNode",c)},next:function(a){return K(a,"nextSibling")},prev:function(a){return K(a,"previousSibling")},nextAll:function(a){return y(a,"nextSibling")},prevAll:function(a){return y(a,"previousSibling")},nextUntil:function(a,b,c){return y(a,"nextSibling",c)},prevUntil:function(a,b,c){return y(a,"previousSibling",c)},siblings:function(a){return z((a.parentNode||{}).firstChild,a)},children:function(a){return z(a.firstChild)},contents:function(a){return B(a,"iframe")?a.contentDocument:(B(a,"template")&&(a=a.content||a),r.merge([],a.childNodes))}},function(a,b){r.fn[a]=function(c,d){var e=r.map(this,b,c);return"Until"!==a.slice(-5)&&(d=c),d&&"string"==typeof d&&(e=r.filter(d,e)),this.length>1&&(J[a]||r.uniqueSort(e),I.test(a)&&e.reverse()),this.pushStack(e)}});var L=/[^\x20\t\r\n\f]+/g;function M(a){var b={};return r.each(a.match(L)||[],function(a,c){b[c]=!0}),b}r.Callbacks=function(a){a="string"==typeof a?M(a):r.extend({},a);var b,c,d,e,f=[],g=[],h=-1,i=function(){for(e=e||a.once,d=b=!0;g.length;h=-1){c=g.shift();while(++h-1)f.splice(c,1),c<=h&&h--}),this},has:function(a){return a?r.inArray(a,f)>-1:f.length>0},empty:function(){return f&&(f=[]),this},disable:function(){return e=g=[],f=c="",this},disabled:function(){return!f},lock:function(){return e=g=[],c||b||(f=c=""),this},locked:function(){return!!e},fireWith:function(a,c){return e||(c=c||[],c=[a,c.slice?c.slice():c],g.push(c),b||i()),this},fire:function(){return j.fireWith(this,arguments),this},fired:function(){return!!d}};return j};function N(a){return a}function O(a){throw a}function P(a,b,c,d){var e;try{a&&r.isFunction(e=a.promise)?e.call(a).done(b).fail(c):a&&r.isFunction(e=a.then)?e.call(a,b,c):b.apply(void 0,[a].slice(d))}catch(a){c.apply(void 0,[a])}}r.extend({Deferred:function(b){var c=[["notify","progress",r.Callbacks("memory"),r.Callbacks("memory"),2],["resolve","done",r.Callbacks("once memory"),r.Callbacks("once memory"),0,"resolved"],["reject","fail",r.Callbacks("once memory"),r.Callbacks("once memory"),1,"rejected"]],d="pending",e={state:function(){return d},always:function(){return f.done(arguments).fail(arguments),this},"catch":function(a){return e.then(null,a)},pipe:function(){var a=arguments;return r.Deferred(function(b){r.each(c,function(c,d){var e=r.isFunction(a[d[4]])&&a[d[4]];f[d[1]](function(){var a=e&&e.apply(this,arguments);a&&r.isFunction(a.promise)?a.promise().progress(b.notify).done(b.resolve).fail(b.reject):b[d[0]+"With"](this,e?[a]:arguments)})}),a=null}).promise()},then:function(b,d,e){var f=0;function g(b,c,d,e){return function(){var h=this,i=arguments,j=function(){var a,j;if(!(b=f&&(d!==O&&(h=void 0,i=[a]),c.rejectWith(h,i))}};b?k():(r.Deferred.getStackHook&&(k.stackTrace=r.Deferred.getStackHook()),a.setTimeout(k))}}return r.Deferred(function(a){c[0][3].add(g(0,a,r.isFunction(e)?e:N,a.notifyWith)),c[1][3].add(g(0,a,r.isFunction(b)?b:N)),c[2][3].add(g(0,a,r.isFunction(d)?d:O))}).promise()},promise:function(a){return null!=a?r.extend(a,e):e}},f={};return r.each(c,function(a,b){var g=b[2],h=b[5];e[b[1]]=g.add,h&&g.add(function(){d=h},c[3-a][2].disable,c[0][2].lock),g.add(b[3].fire),f[b[0]]=function(){return f[b[0]+"With"](this===f?void 0:this,arguments),this},f[b[0]+"With"]=g.fireWith}),e.promise(f),b&&b.call(f,f),f},when:function(a){var b=arguments.length,c=b,d=Array(c),e=f.call(arguments),g=r.Deferred(),h=function(a){return function(c){d[a]=this,e[a]=arguments.length>1?f.call(arguments):c,--b||g.resolveWith(d,e)}};if(b<=1&&(P(a,g.done(h(c)).resolve,g.reject,!b),"pending"===g.state()||r.isFunction(e[c]&&e[c].then)))return g.then();while(c--)P(e[c],h(c),g.reject);return g.promise()}});var Q=/^(Eval|Internal|Range|Reference|Syntax|Type|URI)Error$/;r.Deferred.exceptionHook=function(b,c){a.console&&a.console.warn&&b&&Q.test(b.name)&&a.console.warn("jQuery.Deferred exception: "+b.message,b.stack,c)},r.readyException=function(b){a.setTimeout(function(){throw b})};var R=r.Deferred();r.fn.ready=function(a){return R.then(a)["catch"](function(a){r.readyException(a)}),this},r.extend({isReady:!1,readyWait:1,ready:function(a){(a===!0?--r.readyWait:r.isReady)||(r.isReady=!0,a!==!0&&--r.readyWait>0||R.resolveWith(d,[r]))}}),r.ready.then=R.then;function S(){d.removeEventListener("DOMContentLoaded",S), -a.removeEventListener("load",S),r.ready()}"complete"===d.readyState||"loading"!==d.readyState&&!d.documentElement.doScroll?a.setTimeout(r.ready):(d.addEventListener("DOMContentLoaded",S),a.addEventListener("load",S));var T=function(a,b,c,d,e,f,g){var h=0,i=a.length,j=null==c;if("object"===r.type(c)){e=!0;for(h in c)T(a,b,h,c[h],!0,f,g)}else if(void 0!==d&&(e=!0,r.isFunction(d)||(g=!0),j&&(g?(b.call(a,d),b=null):(j=b,b=function(a,b,c){return j.call(r(a),c)})),b))for(;h1,null,!0)},removeData:function(a){return this.each(function(){X.remove(this,a)})}}),r.extend({queue:function(a,b,c){var d;if(a)return b=(b||"fx")+"queue",d=W.get(a,b),c&&(!d||Array.isArray(c)?d=W.access(a,b,r.makeArray(c)):d.push(c)),d||[]},dequeue:function(a,b){b=b||"fx";var c=r.queue(a,b),d=c.length,e=c.shift(),f=r._queueHooks(a,b),g=function(){r.dequeue(a,b)};"inprogress"===e&&(e=c.shift(),d--),e&&("fx"===b&&c.unshift("inprogress"),delete f.stop,e.call(a,g,f)),!d&&f&&f.empty.fire()},_queueHooks:function(a,b){var c=b+"queueHooks";return W.get(a,c)||W.access(a,c,{empty:r.Callbacks("once memory").add(function(){W.remove(a,[b+"queue",c])})})}}),r.fn.extend({queue:function(a,b){var c=2;return"string"!=typeof a&&(b=a,a="fx",c--),arguments.length\x20\t\r\n\f]+)/i,la=/^$|\/(?:java|ecma)script/i,ma={option:[1,""],thead:[1,"","
"],col:[2,"","
"],tr:[2,"","
"],td:[3,"","
"],_default:[0,"",""]};ma.optgroup=ma.option,ma.tbody=ma.tfoot=ma.colgroup=ma.caption=ma.thead,ma.th=ma.td;function na(a,b){var c;return c="undefined"!=typeof a.getElementsByTagName?a.getElementsByTagName(b||"*"):"undefined"!=typeof a.querySelectorAll?a.querySelectorAll(b||"*"):[],void 0===b||b&&B(a,b)?r.merge([a],c):c}function oa(a,b){for(var c=0,d=a.length;c-1)e&&e.push(f);else if(j=r.contains(f.ownerDocument,f),g=na(l.appendChild(f),"script"),j&&oa(g),c){k=0;while(f=g[k++])la.test(f.type||"")&&c.push(f)}return l}!function(){var a=d.createDocumentFragment(),b=a.appendChild(d.createElement("div")),c=d.createElement("input");c.setAttribute("type","radio"),c.setAttribute("checked","checked"),c.setAttribute("name","t"),b.appendChild(c),o.checkClone=b.cloneNode(!0).cloneNode(!0).lastChild.checked,b.innerHTML="",o.noCloneChecked=!!b.cloneNode(!0).lastChild.defaultValue}();var ra=d.documentElement,sa=/^key/,ta=/^(?:mouse|pointer|contextmenu|drag|drop)|click/,ua=/^([^.]*)(?:\.(.+)|)/;function va(){return!0}function wa(){return!1}function xa(){try{return d.activeElement}catch(a){}}function ya(a,b,c,d,e,f){var g,h;if("object"==typeof b){"string"!=typeof c&&(d=d||c,c=void 0);for(h in b)ya(a,h,c,d,b[h],f);return a}if(null==d&&null==e?(e=c,d=c=void 0):null==e&&("string"==typeof c?(e=d,d=void 0):(e=d,d=c,c=void 0)),e===!1)e=wa;else if(!e)return a;return 1===f&&(g=e,e=function(a){return r().off(a),g.apply(this,arguments)},e.guid=g.guid||(g.guid=r.guid++)),a.each(function(){r.event.add(this,b,e,d,c)})}r.event={global:{},add:function(a,b,c,d,e){var f,g,h,i,j,k,l,m,n,o,p,q=W.get(a);if(q){c.handler&&(f=c,c=f.handler,e=f.selector),e&&r.find.matchesSelector(ra,e),c.guid||(c.guid=r.guid++),(i=q.events)||(i=q.events={}),(g=q.handle)||(g=q.handle=function(b){return"undefined"!=typeof r&&r.event.triggered!==b.type?r.event.dispatch.apply(a,arguments):void 0}),b=(b||"").match(L)||[""],j=b.length;while(j--)h=ua.exec(b[j])||[],n=p=h[1],o=(h[2]||"").split(".").sort(),n&&(l=r.event.special[n]||{},n=(e?l.delegateType:l.bindType)||n,l=r.event.special[n]||{},k=r.extend({type:n,origType:p,data:d,handler:c,guid:c.guid,selector:e,needsContext:e&&r.expr.match.needsContext.test(e),namespace:o.join(".")},f),(m=i[n])||(m=i[n]=[],m.delegateCount=0,l.setup&&l.setup.call(a,d,o,g)!==!1||a.addEventListener&&a.addEventListener(n,g)),l.add&&(l.add.call(a,k),k.handler.guid||(k.handler.guid=c.guid)),e?m.splice(m.delegateCount++,0,k):m.push(k),r.event.global[n]=!0)}},remove:function(a,b,c,d,e){var f,g,h,i,j,k,l,m,n,o,p,q=W.hasData(a)&&W.get(a);if(q&&(i=q.events)){b=(b||"").match(L)||[""],j=b.length;while(j--)if(h=ua.exec(b[j])||[],n=p=h[1],o=(h[2]||"").split(".").sort(),n){l=r.event.special[n]||{},n=(d?l.delegateType:l.bindType)||n,m=i[n]||[],h=h[2]&&new RegExp("(^|\\.)"+o.join("\\.(?:.*\\.|)")+"(\\.|$)"),g=f=m.length;while(f--)k=m[f],!e&&p!==k.origType||c&&c.guid!==k.guid||h&&!h.test(k.namespace)||d&&d!==k.selector&&("**"!==d||!k.selector)||(m.splice(f,1),k.selector&&m.delegateCount--,l.remove&&l.remove.call(a,k));g&&!m.length&&(l.teardown&&l.teardown.call(a,o,q.handle)!==!1||r.removeEvent(a,n,q.handle),delete i[n])}else for(n in i)r.event.remove(a,n+b[j],c,d,!0);r.isEmptyObject(i)&&W.remove(a,"handle events")}},dispatch:function(a){var b=r.event.fix(a),c,d,e,f,g,h,i=new Array(arguments.length),j=(W.get(this,"events")||{})[b.type]||[],k=r.event.special[b.type]||{};for(i[0]=b,c=1;c=1))for(;j!==this;j=j.parentNode||this)if(1===j.nodeType&&("click"!==a.type||j.disabled!==!0)){for(f=[],g={},c=0;c-1:r.find(e,this,null,[j]).length),g[e]&&f.push(d);f.length&&h.push({elem:j,handlers:f})}return j=this,i\x20\t\r\n\f]*)[^>]*)\/>/gi,Aa=/\s*$/g;function Ea(a,b){return B(a,"table")&&B(11!==b.nodeType?b:b.firstChild,"tr")?r(">tbody",a)[0]||a:a}function Fa(a){return a.type=(null!==a.getAttribute("type"))+"/"+a.type,a}function Ga(a){var b=Ca.exec(a.type);return b?a.type=b[1]:a.removeAttribute("type"),a}function Ha(a,b){var c,d,e,f,g,h,i,j;if(1===b.nodeType){if(W.hasData(a)&&(f=W.access(a),g=W.set(b,f),j=f.events)){delete g.handle,g.events={};for(e in j)for(c=0,d=j[e].length;c1&&"string"==typeof q&&!o.checkClone&&Ba.test(q))return a.each(function(e){var f=a.eq(e);s&&(b[0]=q.call(this,e,f.html())),Ja(f,b,c,d)});if(m&&(e=qa(b,a[0].ownerDocument,!1,a,d),f=e.firstChild,1===e.childNodes.length&&(e=f),f||d)){for(h=r.map(na(e,"script"),Fa),i=h.length;l")},clone:function(a,b,c){var d,e,f,g,h=a.cloneNode(!0),i=r.contains(a.ownerDocument,a);if(!(o.noCloneChecked||1!==a.nodeType&&11!==a.nodeType||r.isXMLDoc(a)))for(g=na(h),f=na(a),d=0,e=f.length;d0&&oa(g,!i&&na(a,"script")),h},cleanData:function(a){for(var b,c,d,e=r.event.special,f=0;void 0!==(c=a[f]);f++)if(U(c)){if(b=c[W.expando]){if(b.events)for(d in b.events)e[d]?r.event.remove(c,d):r.removeEvent(c,d,b.handle);c[W.expando]=void 0}c[X.expando]&&(c[X.expando]=void 0)}}}),r.fn.extend({detach:function(a){return Ka(this,a,!0)},remove:function(a){return Ka(this,a)},text:function(a){return T(this,function(a){return void 0===a?r.text(this):this.empty().each(function(){1!==this.nodeType&&11!==this.nodeType&&9!==this.nodeType||(this.textContent=a)})},null,a,arguments.length)},append:function(){return Ja(this,arguments,function(a){if(1===this.nodeType||11===this.nodeType||9===this.nodeType){var b=Ea(this,a);b.appendChild(a)}})},prepend:function(){return Ja(this,arguments,function(a){if(1===this.nodeType||11===this.nodeType||9===this.nodeType){var b=Ea(this,a);b.insertBefore(a,b.firstChild)}})},before:function(){return Ja(this,arguments,function(a){this.parentNode&&this.parentNode.insertBefore(a,this)})},after:function(){return Ja(this,arguments,function(a){this.parentNode&&this.parentNode.insertBefore(a,this.nextSibling)})},empty:function(){for(var a,b=0;null!=(a=this[b]);b++)1===a.nodeType&&(r.cleanData(na(a,!1)),a.textContent="");return this},clone:function(a,b){return a=null!=a&&a,b=null==b?a:b,this.map(function(){return r.clone(this,a,b)})},html:function(a){return T(this,function(a){var b=this[0]||{},c=0,d=this.length;if(void 0===a&&1===b.nodeType)return b.innerHTML;if("string"==typeof a&&!Aa.test(a)&&!ma[(ka.exec(a)||["",""])[1].toLowerCase()]){a=r.htmlPrefilter(a);try{for(;c1)}});function _a(a,b,c,d,e){return new _a.prototype.init(a,b,c,d,e)}r.Tween=_a,_a.prototype={constructor:_a,init:function(a,b,c,d,e,f){this.elem=a,this.prop=c,this.easing=e||r.easing._default,this.options=b,this.start=this.now=this.cur(),this.end=d,this.unit=f||(r.cssNumber[c]?"":"px")},cur:function(){var a=_a.propHooks[this.prop];return a&&a.get?a.get(this):_a.propHooks._default.get(this)},run:function(a){var b,c=_a.propHooks[this.prop];return this.options.duration?this.pos=b=r.easing[this.easing](a,this.options.duration*a,0,1,this.options.duration):this.pos=b=a,this.now=(this.end-this.start)*b+this.start,this.options.step&&this.options.step.call(this.elem,this.now,this),c&&c.set?c.set(this):_a.propHooks._default.set(this),this}},_a.prototype.init.prototype=_a.prototype,_a.propHooks={_default:{get:function(a){var b;return 1!==a.elem.nodeType||null!=a.elem[a.prop]&&null==a.elem.style[a.prop]?a.elem[a.prop]:(b=r.css(a.elem,a.prop,""),b&&"auto"!==b?b:0)},set:function(a){r.fx.step[a.prop]?r.fx.step[a.prop](a):1!==a.elem.nodeType||null==a.elem.style[r.cssProps[a.prop]]&&!r.cssHooks[a.prop]?a.elem[a.prop]=a.now:r.style(a.elem,a.prop,a.now+a.unit)}}},_a.propHooks.scrollTop=_a.propHooks.scrollLeft={set:function(a){a.elem.nodeType&&a.elem.parentNode&&(a.elem[a.prop]=a.now)}},r.easing={linear:function(a){return a},swing:function(a){return.5-Math.cos(a*Math.PI)/2},_default:"swing"},r.fx=_a.prototype.init,r.fx.step={};var ab,bb,cb=/^(?:toggle|show|hide)$/,db=/queueHooks$/;function eb(){bb&&(d.hidden===!1&&a.requestAnimationFrame?a.requestAnimationFrame(eb):a.setTimeout(eb,r.fx.interval),r.fx.tick())}function fb(){return a.setTimeout(function(){ab=void 0}),ab=r.now()}function gb(a,b){var c,d=0,e={height:a};for(b=b?1:0;d<4;d+=2-b)c=ca[d],e["margin"+c]=e["padding"+c]=a;return b&&(e.opacity=e.width=a),e}function hb(a,b,c){for(var d,e=(kb.tweeners[b]||[]).concat(kb.tweeners["*"]),f=0,g=e.length;f1)},removeAttr:function(a){return this.each(function(){r.removeAttr(this,a)})}}),r.extend({attr:function(a,b,c){var d,e,f=a.nodeType;if(3!==f&&8!==f&&2!==f)return"undefined"==typeof a.getAttribute?r.prop(a,b,c):(1===f&&r.isXMLDoc(a)||(e=r.attrHooks[b.toLowerCase()]||(r.expr.match.bool.test(b)?lb:void 0)),void 0!==c?null===c?void r.removeAttr(a,b):e&&"set"in e&&void 0!==(d=e.set(a,c,b))?d:(a.setAttribute(b,c+""),c):e&&"get"in e&&null!==(d=e.get(a,b))?d:(d=r.find.attr(a,b),null==d?void 0:d)); -},attrHooks:{type:{set:function(a,b){if(!o.radioValue&&"radio"===b&&B(a,"input")){var c=a.value;return a.setAttribute("type",b),c&&(a.value=c),b}}}},removeAttr:function(a,b){var c,d=0,e=b&&b.match(L);if(e&&1===a.nodeType)while(c=e[d++])a.removeAttribute(c)}}),lb={set:function(a,b,c){return b===!1?r.removeAttr(a,c):a.setAttribute(c,c),c}},r.each(r.expr.match.bool.source.match(/\w+/g),function(a,b){var c=mb[b]||r.find.attr;mb[b]=function(a,b,d){var e,f,g=b.toLowerCase();return d||(f=mb[g],mb[g]=e,e=null!=c(a,b,d)?g:null,mb[g]=f),e}});var nb=/^(?:input|select|textarea|button)$/i,ob=/^(?:a|area)$/i;r.fn.extend({prop:function(a,b){return T(this,r.prop,a,b,arguments.length>1)},removeProp:function(a){return this.each(function(){delete this[r.propFix[a]||a]})}}),r.extend({prop:function(a,b,c){var d,e,f=a.nodeType;if(3!==f&&8!==f&&2!==f)return 1===f&&r.isXMLDoc(a)||(b=r.propFix[b]||b,e=r.propHooks[b]),void 0!==c?e&&"set"in e&&void 0!==(d=e.set(a,c,b))?d:a[b]=c:e&&"get"in e&&null!==(d=e.get(a,b))?d:a[b]},propHooks:{tabIndex:{get:function(a){var b=r.find.attr(a,"tabindex");return b?parseInt(b,10):nb.test(a.nodeName)||ob.test(a.nodeName)&&a.href?0:-1}}},propFix:{"for":"htmlFor","class":"className"}}),o.optSelected||(r.propHooks.selected={get:function(a){var b=a.parentNode;return b&&b.parentNode&&b.parentNode.selectedIndex,null},set:function(a){var b=a.parentNode;b&&(b.selectedIndex,b.parentNode&&b.parentNode.selectedIndex)}}),r.each(["tabIndex","readOnly","maxLength","cellSpacing","cellPadding","rowSpan","colSpan","useMap","frameBorder","contentEditable"],function(){r.propFix[this.toLowerCase()]=this});function pb(a){var b=a.match(L)||[];return b.join(" ")}function qb(a){return a.getAttribute&&a.getAttribute("class")||""}r.fn.extend({addClass:function(a){var b,c,d,e,f,g,h,i=0;if(r.isFunction(a))return this.each(function(b){r(this).addClass(a.call(this,b,qb(this)))});if("string"==typeof a&&a){b=a.match(L)||[];while(c=this[i++])if(e=qb(c),d=1===c.nodeType&&" "+pb(e)+" "){g=0;while(f=b[g++])d.indexOf(" "+f+" ")<0&&(d+=f+" ");h=pb(d),e!==h&&c.setAttribute("class",h)}}return this},removeClass:function(a){var b,c,d,e,f,g,h,i=0;if(r.isFunction(a))return this.each(function(b){r(this).removeClass(a.call(this,b,qb(this)))});if(!arguments.length)return this.attr("class","");if("string"==typeof a&&a){b=a.match(L)||[];while(c=this[i++])if(e=qb(c),d=1===c.nodeType&&" "+pb(e)+" "){g=0;while(f=b[g++])while(d.indexOf(" "+f+" ")>-1)d=d.replace(" "+f+" "," ");h=pb(d),e!==h&&c.setAttribute("class",h)}}return this},toggleClass:function(a,b){var c=typeof a;return"boolean"==typeof b&&"string"===c?b?this.addClass(a):this.removeClass(a):r.isFunction(a)?this.each(function(c){r(this).toggleClass(a.call(this,c,qb(this),b),b)}):this.each(function(){var b,d,e,f;if("string"===c){d=0,e=r(this),f=a.match(L)||[];while(b=f[d++])e.hasClass(b)?e.removeClass(b):e.addClass(b)}else void 0!==a&&"boolean"!==c||(b=qb(this),b&&W.set(this,"__className__",b),this.setAttribute&&this.setAttribute("class",b||a===!1?"":W.get(this,"__className__")||""))})},hasClass:function(a){var b,c,d=0;b=" "+a+" ";while(c=this[d++])if(1===c.nodeType&&(" "+pb(qb(c))+" ").indexOf(b)>-1)return!0;return!1}});var rb=/\r/g;r.fn.extend({val:function(a){var b,c,d,e=this[0];{if(arguments.length)return d=r.isFunction(a),this.each(function(c){var e;1===this.nodeType&&(e=d?a.call(this,c,r(this).val()):a,null==e?e="":"number"==typeof e?e+="":Array.isArray(e)&&(e=r.map(e,function(a){return null==a?"":a+""})),b=r.valHooks[this.type]||r.valHooks[this.nodeName.toLowerCase()],b&&"set"in b&&void 0!==b.set(this,e,"value")||(this.value=e))});if(e)return b=r.valHooks[e.type]||r.valHooks[e.nodeName.toLowerCase()],b&&"get"in b&&void 0!==(c=b.get(e,"value"))?c:(c=e.value,"string"==typeof c?c.replace(rb,""):null==c?"":c)}}}),r.extend({valHooks:{option:{get:function(a){var b=r.find.attr(a,"value");return null!=b?b:pb(r.text(a))}},select:{get:function(a){var b,c,d,e=a.options,f=a.selectedIndex,g="select-one"===a.type,h=g?null:[],i=g?f+1:e.length;for(d=f<0?i:g?f:0;d-1)&&(c=!0);return c||(a.selectedIndex=-1),f}}}}),r.each(["radio","checkbox"],function(){r.valHooks[this]={set:function(a,b){if(Array.isArray(b))return a.checked=r.inArray(r(a).val(),b)>-1}},o.checkOn||(r.valHooks[this].get=function(a){return null===a.getAttribute("value")?"on":a.value})});var sb=/^(?:focusinfocus|focusoutblur)$/;r.extend(r.event,{trigger:function(b,c,e,f){var g,h,i,j,k,m,n,o=[e||d],p=l.call(b,"type")?b.type:b,q=l.call(b,"namespace")?b.namespace.split("."):[];if(h=i=e=e||d,3!==e.nodeType&&8!==e.nodeType&&!sb.test(p+r.event.triggered)&&(p.indexOf(".")>-1&&(q=p.split("."),p=q.shift(),q.sort()),k=p.indexOf(":")<0&&"on"+p,b=b[r.expando]?b:new r.Event(p,"object"==typeof b&&b),b.isTrigger=f?2:3,b.namespace=q.join("."),b.rnamespace=b.namespace?new RegExp("(^|\\.)"+q.join("\\.(?:.*\\.|)")+"(\\.|$)"):null,b.result=void 0,b.target||(b.target=e),c=null==c?[b]:r.makeArray(c,[b]),n=r.event.special[p]||{},f||!n.trigger||n.trigger.apply(e,c)!==!1)){if(!f&&!n.noBubble&&!r.isWindow(e)){for(j=n.delegateType||p,sb.test(j+p)||(h=h.parentNode);h;h=h.parentNode)o.push(h),i=h;i===(e.ownerDocument||d)&&o.push(i.defaultView||i.parentWindow||a)}g=0;while((h=o[g++])&&!b.isPropagationStopped())b.type=g>1?j:n.bindType||p,m=(W.get(h,"events")||{})[b.type]&&W.get(h,"handle"),m&&m.apply(h,c),m=k&&h[k],m&&m.apply&&U(h)&&(b.result=m.apply(h,c),b.result===!1&&b.preventDefault());return b.type=p,f||b.isDefaultPrevented()||n._default&&n._default.apply(o.pop(),c)!==!1||!U(e)||k&&r.isFunction(e[p])&&!r.isWindow(e)&&(i=e[k],i&&(e[k]=null),r.event.triggered=p,e[p](),r.event.triggered=void 0,i&&(e[k]=i)),b.result}},simulate:function(a,b,c){var d=r.extend(new r.Event,c,{type:a,isSimulated:!0});r.event.trigger(d,null,b)}}),r.fn.extend({trigger:function(a,b){return this.each(function(){r.event.trigger(a,b,this)})},triggerHandler:function(a,b){var c=this[0];if(c)return r.event.trigger(a,b,c,!0)}}),r.each("blur focus focusin focusout resize scroll click dblclick mousedown mouseup mousemove mouseover mouseout mouseenter mouseleave change select submit keydown keypress keyup contextmenu".split(" "),function(a,b){r.fn[b]=function(a,c){return arguments.length>0?this.on(b,null,a,c):this.trigger(b)}}),r.fn.extend({hover:function(a,b){return this.mouseenter(a).mouseleave(b||a)}}),o.focusin="onfocusin"in a,o.focusin||r.each({focus:"focusin",blur:"focusout"},function(a,b){var c=function(a){r.event.simulate(b,a.target,r.event.fix(a))};r.event.special[b]={setup:function(){var d=this.ownerDocument||this,e=W.access(d,b);e||d.addEventListener(a,c,!0),W.access(d,b,(e||0)+1)},teardown:function(){var d=this.ownerDocument||this,e=W.access(d,b)-1;e?W.access(d,b,e):(d.removeEventListener(a,c,!0),W.remove(d,b))}}});var tb=a.location,ub=r.now(),vb=/\?/;r.parseXML=function(b){var c;if(!b||"string"!=typeof b)return null;try{c=(new a.DOMParser).parseFromString(b,"text/xml")}catch(d){c=void 0}return c&&!c.getElementsByTagName("parsererror").length||r.error("Invalid XML: "+b),c};var wb=/\[\]$/,xb=/\r?\n/g,yb=/^(?:submit|button|image|reset|file)$/i,zb=/^(?:input|select|textarea|keygen)/i;function Ab(a,b,c,d){var e;if(Array.isArray(b))r.each(b,function(b,e){c||wb.test(a)?d(a,e):Ab(a+"["+("object"==typeof e&&null!=e?b:"")+"]",e,c,d)});else if(c||"object"!==r.type(b))d(a,b);else for(e in b)Ab(a+"["+e+"]",b[e],c,d)}r.param=function(a,b){var c,d=[],e=function(a,b){var c=r.isFunction(b)?b():b;d[d.length]=encodeURIComponent(a)+"="+encodeURIComponent(null==c?"":c)};if(Array.isArray(a)||a.jquery&&!r.isPlainObject(a))r.each(a,function(){e(this.name,this.value)});else for(c in a)Ab(c,a[c],b,e);return d.join("&")},r.fn.extend({serialize:function(){return r.param(this.serializeArray())},serializeArray:function(){return this.map(function(){var a=r.prop(this,"elements");return a?r.makeArray(a):this}).filter(function(){var a=this.type;return this.name&&!r(this).is(":disabled")&&zb.test(this.nodeName)&&!yb.test(a)&&(this.checked||!ja.test(a))}).map(function(a,b){var c=r(this).val();return null==c?null:Array.isArray(c)?r.map(c,function(a){return{name:b.name,value:a.replace(xb,"\r\n")}}):{name:b.name,value:c.replace(xb,"\r\n")}}).get()}});var Bb=/%20/g,Cb=/#.*$/,Db=/([?&])_=[^&]*/,Eb=/^(.*?):[ \t]*([^\r\n]*)$/gm,Fb=/^(?:about|app|app-storage|.+-extension|file|res|widget):$/,Gb=/^(?:GET|HEAD)$/,Hb=/^\/\//,Ib={},Jb={},Kb="*/".concat("*"),Lb=d.createElement("a");Lb.href=tb.href;function Mb(a){return function(b,c){"string"!=typeof b&&(c=b,b="*");var d,e=0,f=b.toLowerCase().match(L)||[];if(r.isFunction(c))while(d=f[e++])"+"===d[0]?(d=d.slice(1)||"*",(a[d]=a[d]||[]).unshift(c)):(a[d]=a[d]||[]).push(c)}}function Nb(a,b,c,d){var e={},f=a===Jb;function g(h){var i;return e[h]=!0,r.each(a[h]||[],function(a,h){var j=h(b,c,d);return"string"!=typeof j||f||e[j]?f?!(i=j):void 0:(b.dataTypes.unshift(j),g(j),!1)}),i}return g(b.dataTypes[0])||!e["*"]&&g("*")}function Ob(a,b){var c,d,e=r.ajaxSettings.flatOptions||{};for(c in b)void 0!==b[c]&&((e[c]?a:d||(d={}))[c]=b[c]);return d&&r.extend(!0,a,d),a}function Pb(a,b,c){var d,e,f,g,h=a.contents,i=a.dataTypes;while("*"===i[0])i.shift(),void 0===d&&(d=a.mimeType||b.getResponseHeader("Content-Type"));if(d)for(e in h)if(h[e]&&h[e].test(d)){i.unshift(e);break}if(i[0]in c)f=i[0];else{for(e in c){if(!i[0]||a.converters[e+" "+i[0]]){f=e;break}g||(g=e)}f=f||g}if(f)return f!==i[0]&&i.unshift(f),c[f]}function Qb(a,b,c,d){var e,f,g,h,i,j={},k=a.dataTypes.slice();if(k[1])for(g in a.converters)j[g.toLowerCase()]=a.converters[g];f=k.shift();while(f)if(a.responseFields[f]&&(c[a.responseFields[f]]=b),!i&&d&&a.dataFilter&&(b=a.dataFilter(b,a.dataType)),i=f,f=k.shift())if("*"===f)f=i;else if("*"!==i&&i!==f){if(g=j[i+" "+f]||j["* "+f],!g)for(e in j)if(h=e.split(" "),h[1]===f&&(g=j[i+" "+h[0]]||j["* "+h[0]])){g===!0?g=j[e]:j[e]!==!0&&(f=h[0],k.unshift(h[1]));break}if(g!==!0)if(g&&a["throws"])b=g(b);else try{b=g(b)}catch(l){return{state:"parsererror",error:g?l:"No conversion from "+i+" to "+f}}}return{state:"success",data:b}}r.extend({active:0,lastModified:{},etag:{},ajaxSettings:{url:tb.href,type:"GET",isLocal:Fb.test(tb.protocol),global:!0,processData:!0,async:!0,contentType:"application/x-www-form-urlencoded; charset=UTF-8",accepts:{"*":Kb,text:"text/plain",html:"text/html",xml:"application/xml, text/xml",json:"application/json, text/javascript"},contents:{xml:/\bxml\b/,html:/\bhtml/,json:/\bjson\b/},responseFields:{xml:"responseXML",text:"responseText",json:"responseJSON"},converters:{"* text":String,"text html":!0,"text json":JSON.parse,"text xml":r.parseXML},flatOptions:{url:!0,context:!0}},ajaxSetup:function(a,b){return b?Ob(Ob(a,r.ajaxSettings),b):Ob(r.ajaxSettings,a)},ajaxPrefilter:Mb(Ib),ajaxTransport:Mb(Jb),ajax:function(b,c){"object"==typeof b&&(c=b,b=void 0),c=c||{};var e,f,g,h,i,j,k,l,m,n,o=r.ajaxSetup({},c),p=o.context||o,q=o.context&&(p.nodeType||p.jquery)?r(p):r.event,s=r.Deferred(),t=r.Callbacks("once memory"),u=o.statusCode||{},v={},w={},x="canceled",y={readyState:0,getResponseHeader:function(a){var b;if(k){if(!h){h={};while(b=Eb.exec(g))h[b[1].toLowerCase()]=b[2]}b=h[a.toLowerCase()]}return null==b?null:b},getAllResponseHeaders:function(){return k?g:null},setRequestHeader:function(a,b){return null==k&&(a=w[a.toLowerCase()]=w[a.toLowerCase()]||a,v[a]=b),this},overrideMimeType:function(a){return null==k&&(o.mimeType=a),this},statusCode:function(a){var b;if(a)if(k)y.always(a[y.status]);else for(b in a)u[b]=[u[b],a[b]];return this},abort:function(a){var b=a||x;return e&&e.abort(b),A(0,b),this}};if(s.promise(y),o.url=((b||o.url||tb.href)+"").replace(Hb,tb.protocol+"//"),o.type=c.method||c.type||o.method||o.type,o.dataTypes=(o.dataType||"*").toLowerCase().match(L)||[""],null==o.crossDomain){j=d.createElement("a");try{j.href=o.url,j.href=j.href,o.crossDomain=Lb.protocol+"//"+Lb.host!=j.protocol+"//"+j.host}catch(z){o.crossDomain=!0}}if(o.data&&o.processData&&"string"!=typeof o.data&&(o.data=r.param(o.data,o.traditional)),Nb(Ib,o,c,y),k)return y;l=r.event&&o.global,l&&0===r.active++&&r.event.trigger("ajaxStart"),o.type=o.type.toUpperCase(),o.hasContent=!Gb.test(o.type),f=o.url.replace(Cb,""),o.hasContent?o.data&&o.processData&&0===(o.contentType||"").indexOf("application/x-www-form-urlencoded")&&(o.data=o.data.replace(Bb,"+")):(n=o.url.slice(f.length),o.data&&(f+=(vb.test(f)?"&":"?")+o.data,delete o.data),o.cache===!1&&(f=f.replace(Db,"$1"),n=(vb.test(f)?"&":"?")+"_="+ub++ +n),o.url=f+n),o.ifModified&&(r.lastModified[f]&&y.setRequestHeader("If-Modified-Since",r.lastModified[f]),r.etag[f]&&y.setRequestHeader("If-None-Match",r.etag[f])),(o.data&&o.hasContent&&o.contentType!==!1||c.contentType)&&y.setRequestHeader("Content-Type",o.contentType),y.setRequestHeader("Accept",o.dataTypes[0]&&o.accepts[o.dataTypes[0]]?o.accepts[o.dataTypes[0]]+("*"!==o.dataTypes[0]?", "+Kb+"; q=0.01":""):o.accepts["*"]);for(m in o.headers)y.setRequestHeader(m,o.headers[m]);if(o.beforeSend&&(o.beforeSend.call(p,y,o)===!1||k))return y.abort();if(x="abort",t.add(o.complete),y.done(o.success),y.fail(o.error),e=Nb(Jb,o,c,y)){if(y.readyState=1,l&&q.trigger("ajaxSend",[y,o]),k)return y;o.async&&o.timeout>0&&(i=a.setTimeout(function(){y.abort("timeout")},o.timeout));try{k=!1,e.send(v,A)}catch(z){if(k)throw z;A(-1,z)}}else A(-1,"No Transport");function A(b,c,d,h){var j,m,n,v,w,x=c;k||(k=!0,i&&a.clearTimeout(i),e=void 0,g=h||"",y.readyState=b>0?4:0,j=b>=200&&b<300||304===b,d&&(v=Pb(o,y,d)),v=Qb(o,v,y,j),j?(o.ifModified&&(w=y.getResponseHeader("Last-Modified"),w&&(r.lastModified[f]=w),w=y.getResponseHeader("etag"),w&&(r.etag[f]=w)),204===b||"HEAD"===o.type?x="nocontent":304===b?x="notmodified":(x=v.state,m=v.data,n=v.error,j=!n)):(n=x,!b&&x||(x="error",b<0&&(b=0))),y.status=b,y.statusText=(c||x)+"",j?s.resolveWith(p,[m,x,y]):s.rejectWith(p,[y,x,n]),y.statusCode(u),u=void 0,l&&q.trigger(j?"ajaxSuccess":"ajaxError",[y,o,j?m:n]),t.fireWith(p,[y,x]),l&&(q.trigger("ajaxComplete",[y,o]),--r.active||r.event.trigger("ajaxStop")))}return y},getJSON:function(a,b,c){return r.get(a,b,c,"json")},getScript:function(a,b){return r.get(a,void 0,b,"script")}}),r.each(["get","post"],function(a,b){r[b]=function(a,c,d,e){return r.isFunction(c)&&(e=e||d,d=c,c=void 0),r.ajax(r.extend({url:a,type:b,dataType:e,data:c,success:d},r.isPlainObject(a)&&a))}}),r._evalUrl=function(a){return r.ajax({url:a,type:"GET",dataType:"script",cache:!0,async:!1,global:!1,"throws":!0})},r.fn.extend({wrapAll:function(a){var b;return this[0]&&(r.isFunction(a)&&(a=a.call(this[0])),b=r(a,this[0].ownerDocument).eq(0).clone(!0),this[0].parentNode&&b.insertBefore(this[0]),b.map(function(){var a=this;while(a.firstElementChild)a=a.firstElementChild;return a}).append(this)),this},wrapInner:function(a){return r.isFunction(a)?this.each(function(b){r(this).wrapInner(a.call(this,b))}):this.each(function(){var b=r(this),c=b.contents();c.length?c.wrapAll(a):b.append(a)})},wrap:function(a){var b=r.isFunction(a);return this.each(function(c){r(this).wrapAll(b?a.call(this,c):a)})},unwrap:function(a){return this.parent(a).not("body").each(function(){r(this).replaceWith(this.childNodes)}),this}}),r.expr.pseudos.hidden=function(a){return!r.expr.pseudos.visible(a)},r.expr.pseudos.visible=function(a){return!!(a.offsetWidth||a.offsetHeight||a.getClientRects().length)},r.ajaxSettings.xhr=function(){try{return new a.XMLHttpRequest}catch(b){}};var Rb={0:200,1223:204},Sb=r.ajaxSettings.xhr();o.cors=!!Sb&&"withCredentials"in Sb,o.ajax=Sb=!!Sb,r.ajaxTransport(function(b){var c,d;if(o.cors||Sb&&!b.crossDomain)return{send:function(e,f){var g,h=b.xhr();if(h.open(b.type,b.url,b.async,b.username,b.password),b.xhrFields)for(g in b.xhrFields)h[g]=b.xhrFields[g];b.mimeType&&h.overrideMimeType&&h.overrideMimeType(b.mimeType),b.crossDomain||e["X-Requested-With"]||(e["X-Requested-With"]="XMLHttpRequest");for(g in e)h.setRequestHeader(g,e[g]);c=function(a){return function(){c&&(c=d=h.onload=h.onerror=h.onabort=h.onreadystatechange=null,"abort"===a?h.abort():"error"===a?"number"!=typeof h.status?f(0,"error"):f(h.status,h.statusText):f(Rb[h.status]||h.status,h.statusText,"text"!==(h.responseType||"text")||"string"!=typeof h.responseText?{binary:h.response}:{text:h.responseText},h.getAllResponseHeaders()))}},h.onload=c(),d=h.onerror=c("error"),void 0!==h.onabort?h.onabort=d:h.onreadystatechange=function(){4===h.readyState&&a.setTimeout(function(){c&&d()})},c=c("abort");try{h.send(b.hasContent&&b.data||null)}catch(i){if(c)throw i}},abort:function(){c&&c()}}}),r.ajaxPrefilter(function(a){a.crossDomain&&(a.contents.script=!1)}),r.ajaxSetup({accepts:{script:"text/javascript, application/javascript, application/ecmascript, application/x-ecmascript"},contents:{script:/\b(?:java|ecma)script\b/},converters:{"text script":function(a){return r.globalEval(a),a}}}),r.ajaxPrefilter("script",function(a){void 0===a.cache&&(a.cache=!1),a.crossDomain&&(a.type="GET")}),r.ajaxTransport("script",function(a){if(a.crossDomain){var b,c;return{send:function(e,f){b=r("'),200,'Valid user note is saved') + expect(app.post('Users.deleteUser',user_serial=member['user_serial']),409,'User with note history cannot be deleted') + body=expect(app.request(data={'action':'Users.userSummary','user_serial':member['user_serial'],'csrf_token':csrf}),200,'User summary no longer depends on subscriptions') + check(b'<script>text only</script>' in body,'Notes are escaped in the summary') + expect(app.post('Users.userActive',user_serial=member['user_serial']),200,'User usage check no longer queries requests') + expect(app.post('Roster.workspace',step='club',club_serial=0,club_name='North Woods'),200,'First club can be created') + club_a=app.fixture('inspect')['clubs'][0]['club_serial'] + expect(app.post('Roster.workspace',step='club',club_serial=0,club_name='South Woods'),200,'Second club can be created') + club_b=app.fixture('inspect')['clubs'][-1]['club_serial'] + for club in [club_a,club_b]: + expect(app.post('Roster.workspace',step='season',club_serial=club,season_name='2026 Season',starts_on='2026-01-01',ends_on='2026-12-31'),200,'Club season can be created') + expect(app.post('Roster.workspace',step='season',club_serial=club_a,season_name='Invalid',starts_on='2026-12-31',ends_on='2026-01-01'),422,'Reversed season dates are rejected') + expect(app.post('Roster.workspace',step='member',club_serial=club_a,identifier='member_one',membership_status='active',joined_on='2026-01-01'),409,'Unverified accounts cannot receive active memberships') + app.fixture('verifyEmail','member_one') + expect(app.post('Roster.workspace',step='member',club_serial=club_a,identifier='member_one',membership_status='active',joined_on='2026-01-01'),200,'Account can be assigned to a club') + expect(app.post('Roster.workspace',step='member',club_serial=club_a,identifier='member_one',membership_status='active',joined_on='2026-01-01'),409,'Duplicate club membership is rejected') + state=app.fixture('inspect');membership=state['club_memberships'][0]['membership_serial'];season_a=state['club_seasons'][0]['season_serial'];season_b=state['club_seasons'][1]['season_serial'] + expect(app.post('Roster.workspace',step='charge',club_serial=club_a,membership_serial=membership,season_serial=season_b,amount='100.00'),409,'Cross-club season cannot be used for dues') + expect(app.post('Roster.workspace',step='charge',club_serial=club_a,membership_serial=membership,season_serial=season_a,amount='100.001'),422,'Money rejects fractional cents') + expect(app.post('Roster.workspace',step='charge',club_serial=club_a,membership_serial=membership,season_serial=season_a,amount='100.00'),200,'Season dues can be recorded') + expect(app.post('Roster.workspace',step='charge',club_serial=club_a,membership_serial=membership,season_serial=season_a,amount='100.00'),409,'Duplicate season dues are rejected') + due=app.fixture('inspect')['club_dues'][0]['due_serial'];key=secrets.token_hex(32) + payment=dict(step='payment',club_serial=club_a,due_serial=due,amount='3.14',paid_on='2026-01-02',request_key=key) + expect(app.post('Roster.workspace',**payment),200,'Received payment can be recorded') + expect(app.post('Roster.workspace',**payment),200,'Repeated payment submission is idempotent') + check(len(app.fixture('inspect')['club_payments'])==1,'Payment retry does not double-charge the ledger') + expect(app.post('Roster.workspace',**{**payment,'amount':'100.00','request_key':secrets.token_hex(32)}),409,'Payment above balance is rejected') + for action,signature in [('csv',b'Club,Username'),('excel',b'PK'),('pdf',b'%PDF')]: + body=expect(app.request(data={'action':'RosterReports.'+action,'club_serial':club_a,'csrf_token':csrf}),200,action+' report downloads successfully') + check(body.startswith(signature),action+' report has the correct file format') + if action=='excel': + with zipfile.ZipFile(io.BytesIO(body)) as archive: + root=ElementTree.fromstring(archive.read('xl/worksheets/sheet1.xml')) + check(not root.findall('.//{http://schemas.openxmlformats.org/spreadsheetml/2006/main}f'),'Spreadsheet cells do not contain formulas') + body=expect(app.post('Users.editUser',step='update',user_serial=member['user_serial'],user_name='member_one',user_first_name='=HYPERLINK("unsafe")',user_last_name='Updated',user_email='member@example.test',user_role='User',user_active='true'),200,'Administrator can edit first and last names') + body=app.request(data={'action':'RosterReports.csv','club_serial':club_a,'csrf_token':csrf})[1] + check(b"'=HYPERLINK" in body,'CSV formula text is neutralized') + # Set a known member password in this disposable fixture via the real reset flow. + # Fixture token generation is intentionally scoped to httpuser, so create that + # account through signup and assign it separately for isolation tests. + app.logout();_,signup,_=app.request('/?Xaction=signup') + expect(app.request(data={'action':'SignUp.createAccount','csrf_token':app.csrf(signup),'user_first_name':'Regular','user_last_name':'Member','user_email':'http@example.test','user_name':'httpuser','user_password':'HTTP long password!','user_password_confirm':'HTTP long password!'}),200,'Regular member account can sign up') + app.login();csrf=app.token + app.fixture('verifyEmail','httpuser') + app.post('Roster.workspace',step='member',club_serial=club_a,identifier='httpuser',membership_status='active',joined_on='2026-01-01') + app.logout();app.login('http@example.test','HTTP long password!') + body=expect(app.request('/?Xaction=Roster.workspace&club_serial='+str(club_a)),200,'Member can view assigned club') + check(b'South Woods' not in body,'Other clubs are absent from member navigation') + check(b'$100.00' not in body,'Member cannot view another member dues') + expect(app.request('/?Xaction=Roster.workspace&club_serial='+str(club_b)),403,'Member cannot access another club by changing its ID') + expect(app.post('Roster.workspace',step='club',club_serial=0,club_name='Unauthorized'),403,'Member cannot create clubs') + expect(app.post('RosterReports.csv',club_serial=club_a),403,'Member cannot download administrator exports') + expect(app.post('Users.deleteUser',user_serial=member['user_serial']),403,'Member cannot delete accounts') + # Keep that member session alive while a separate administrator session changes + # membership/club status; access must be rechecked on each request. + member_client=app.client + import urllib.request,http.cookiejar + app.client=urllib.request.build_opener(urllib.request.HTTPCookieProcessor(http.cookiejar.CookieJar())) + app.login();csrf=app.token;admin_client=app.client + http_membership=next(row['membership_serial'] for row in app.fixture('inspect')['club_memberships'] if row['user_serial']==next(user['user_serial'] for user in app.fixture('inspect')['users'] if user['user_name']=='httpuser')) + expect(app.post('Roster.workspace',step='member',club_serial=club_a,membership_serial=http_membership,membership_status='inactive',joined_on='2026-01-01'),200,'Membership can be made inactive while preserving history') + app.client=member_client + expect(app.request('/?Xaction=Roster.workspace&club_serial='+str(club_a)),403,'Inactive membership immediately loses club access in an existing session') + app.client=admin_client + app.post('Roster.workspace',step='member',club_serial=club_a,membership_serial=http_membership,membership_status='active',joined_on='2026-01-01') + expect(app.post('Roster.workspace',step='club',club_serial=club_a,club_name='North Woods',club_status='archived'),200,'Club can be archived without deleting its history') + app.client=member_client + expect(app.request('/?Xaction=Roster.workspace&club_serial='+str(club_a)),403,'Archived club is inaccessible to ordinary members') + app.client=admin_client + expect(app.post('Roster.workspace',step='club',club_serial=club_a,club_name='North Woods',club_status='active'),200,'Archived club can be reactivated') + check(len(app.fixture('inspect')['club_payments'])==1,'Archiving and reactivation preserve the payment ledger') + body=expect(app.request(data={'action':'Journal.viewJournal','csrf_token':csrf}),200,'Journal page loads after authentication events') + check(b'logged in' in body,'Authentication writes journal entries') + for action in ['Users.setupUsers','Dropdowns.setupDropdowntypes','Statuses.setupStatuses','Alerts.setupAlerts','Popovers.setupPopovers','Journal.viewJournal']: + expect(app.request(data={'action':action,'pagination':'last','csrf_token':csrf}),200,action+' handles last page without SQL errors') + body=expect(app.post('getZipcode',zip_code='12345'),200,'ZIP lookup uses a valid route and JSON response') + json.loads(body) + app.fixture('paging') + from lxml import html as parser + import re + response=app.request(data={'action':'Popovers.setupPopovers','pagination':'last','csrf_token':csrf}) + body=expect(response,200,'Last-page query works with 41 real records') + text=re.sub(r'\s+',' ',parser.fromstring(body).text_content()) + check('Showing 41 to 41 of 41' in text,'Last page starts at record 41 rather than record 22') + body=app.request(data={'action':'Users.setupUsers','csrf_token':csrf})[1] + text=re.sub(r'\s+',' ',parser.fromstring(body).text_content()) + check('Showing 1 to 20 of 44' in text,'User pagination is independent of popover pagination') + body=app.request(data={'action':'Users.setupUsers','find_user':'Family41','csrf_token':csrf})[1] + check(b'Family41' in body and b'paging40@example.test' not in body,'Users can be searched by last name') + body=app.request(data={'action':'Popovers.setupPopovers','pagination':'first','popovers_per_page':'40','csrf_token':csrf})[1] + text=re.sub(r'\s+',' ',parser.fromstring(body).text_content()) + check('Showing 1 to 40 of 41' in text,'Per-page selection is respected') + expect(app.post('Journal.clearJournal'),404,'Journal-clearing endpoint is no longer routable') + expect(app.post('Roster.workspace',step='adjust',club_serial=club_a,due_serial=due,corrected_amount='90.00',reason='HTTP correction',request_key=secrets.token_hex(32)),200,'Dues corrections work through the protected HTTP route') + expect(app.post('Roster.workspace',step='payment',club_serial=club_a,due_serial=due,amount='1.00',paid_on='2026-01-02',request_key=secrets.token_hex(32),payment_method='check',payment_reference='=SUM(1,1)'),200,'Payment references and methods are saved through HTTP') + new_payment=app.fixture('inspect')['club_payments'][-1]['payment_serial'] + expect(app.post('Roster.workspace',step='reverse',club_serial=club_a,payment_serial=new_payment,reason='HTTP reversal',request_key=secrets.token_hex(32)),200,'Payment reversals work through the protected HTTP route') + body=expect(app.request(data={'action':'RosterReports.ledger','club_serial':club_a,'csrf_token':csrf}),200,'Financial history exports through HTTP') + check(b"'=SUM(1,1)" in body,'Financial CSV neutralizes formula text in payment references') + check(b'HTTP correction' in body and b'HTTP reversal' in body,'Financial CSV includes correction and reversal reasons') + body=expect(app.request('/?Xaction=verifyemail'),200,'Public email verification page renders') + expect(app.request(data={'action':'verifyemail','step':'confirm','token':'0'*64,'user_password':'wrong'}),403,'Email verification rejects a missing CSRF token') + headers=app.request()[2] + check("script-src 'self'" in headers['Content-Security-Policy'],'Application sends a CSP without inline-script permission') + + print('\n'.join('PASS: '+message for message in checks)) + print(f'{len(checks)} project HTTP checks passed.') +finally:app.close() diff --git a/tests/run.py b/tests/run.py new file mode 100644 index 0000000..69c9541 --- /dev/null +++ b/tests/run.py @@ -0,0 +1,7 @@ +import json,os,subprocess,sys +from pathlib import Path +ROOT=Path(__file__).resolve().parents[1] +php=json.loads(os.environ.get('PHP_TEST_COMMAND','["php"]')) +if not os.environ.get('HCR_TEST_DSN'):raise SystemExit('Configure an isolated HCR_TEST_DSN before running integration tests.') +for suite in ['tests/source_checks.py','tests/auth_integration.php','tests/maintenance_unit.php','tests/auth_http.py','tests/project_http.py','tests/production_runner.py','tests/concurrency.py','tests/browser_runner.py','tests/deployment_tools.py']: + subprocess.run((php if suite.endswith('.php') else [sys.executable])+[suite],cwd=ROOT,check=True) diff --git a/tests/runtime_privileges.php b/tests/runtime_privileges.php new file mode 100644 index 0000000..0181db8 --- /dev/null +++ b/tests/runtime_privileges.php @@ -0,0 +1,17 @@ +getSettings();$name=(string)$settings->DatabaseName; +if(!preg_match('/\Ahcr_http_test_[a-f0-9]{12}\z/',$name))throw new RuntimeException('Disposable database required.'); +$db=(new Base())->connect();$account='hcr_check_'.bin2hex(random_bytes(6));$password=bin2hex(random_bytes(24));$identity=$db->quote($account)."@'%'"; +$db->exec('CREATE USER '.$identity.' IDENTIFIED BY '.$db->quote($password)); +try{ + $sql=file_get_contents(__DIR__.'/../deploy/runtime-grants.sql.example');$sql=preg_replace('/^--.*$/m','',$sql);$sql=str_replace(['huntingclubroster',"'hcr_runtime'@'app-host.example'"],[$name,$identity],$sql); + foreach(explode(';',$sql) as $statement)if(trim($statement))$db->exec($statement); + $limited=new PDO('mysql:host='.$settings->DatabaseServer.';port='.(int)$settings->DatabasePort.';dbname='.$name,$account,$password,[PDO::ATTR_ERRMODE=>PDO::ERRMODE_EXCEPTION]); + $limited->beginTransaction();Audit::required($limited,1,'runtime privilege verification');$limited->commit();$checks=1; + foreach(['DELETE FROM journal','UPDATE club_payments SET amount_cents=amount_cents','DELETE FROM club_dues','ALTER TABLE clubs ADD COLUMN forbidden INT'] as $statement){ + try{$limited->exec($statement);throw new RuntimeException('A forbidden runtime operation was allowed.');}catch(PDOException $e){if(!in_array((int)($e->errorInfo[1]??0),[1142,1143],true))throw $e;$checks++;} + } + echo "$checks runtime privilege checks passed: audit inserts work; history deletion, payment edits, and schema changes are denied.\n"; +}finally{$db->exec('DROP USER '.$identity);} diff --git a/tests/source_checks.py b/tests/source_checks.py new file mode 100644 index 0000000..8e66d56 --- /dev/null +++ b/tests/source_checks.py @@ -0,0 +1,20 @@ +import base64,hashlib,json,os,subprocess,sys +from pathlib import Path +from lxml import etree +ROOT=Path(__file__).resolve().parents[1] +php=json.loads(os.environ.get('PHP_TEST_COMMAND','["php"]'));node=os.environ.get('NODE_TEST_COMMAND','node') +files=[ROOT/'main.php']+[f for directory in ['classes','bin','tests'] for f in (ROOT/directory).glob('*.php')] +for file in files: + result=subprocess.run(php+['-l',str(file)],cwd=ROOT,capture_output=True,text=True) + if result.returncode:raise RuntimeError(result.stdout+result.stderr) +scripts=list((ROOT/'js').glob('*.js')) +for file in scripts: + result=subprocess.run([node,'--check',str(file)],capture_output=True,text=True) + if result.returncode:raise RuntimeError(result.stdout+result.stderr) +styles=list((ROOT/'xsl').glob('*.xsl')) +for file in styles:etree.XSLT(etree.parse(str(file))) +dependency=json.loads((ROOT/'browser-dependencies.json').read_text())['jquery'] +assert base64.b64encode(hashlib.sha256((ROOT/dependency['file']).read_bytes()).digest()).decode()==dependency['sha256_base64'] +assert not (ROOT/'js/jquery-3.2.0.min.js').exists() +assert all('jquery-3.2.0' not in file.read_text(encoding='utf-8-sig') for file in styles) +print(f'Source checks passed: {len(files)} PHP files, {len(scripts)} JavaScript files, {len(styles)} XSL stylesheets, and jQuery integrity.') diff --git a/web.config b/web.config index dc42a3c..fe5c013 100644 --- a/web.config +++ b/web.config @@ -10,6 +10,17 @@ + + + + + + + + + + + diff --git a/xsl/addDropdowntype.xsl b/xsl/addDropdowntype.xsl index 7ca9032..60bd0a6 100644 --- a/xsl/addDropdowntype.xsl +++ b/xsl/addDropdowntype.xsl @@ -1,67 +1,70 @@ - + - + - 1.0 - Add Dropdown Type - addDropdowntype + 1.0 + Add Dropdown Type + addDropdowntype - - - + + + + Create account · <xsl:value-of select="$APPLICATION_NAME"/> + + + + + + + + - + @@ -122,7 +129,7 @@
diff --git a/xsl/editDropdowntype.xsl b/xsl/editDropdowntype.xsl index 5161a66..35fa52d 100644 --- a/xsl/editDropdowntype.xsl +++ b/xsl/editDropdowntype.xsl @@ -10,27 +10,27 @@ editDropdowntype - - + @@ -50,7 +50,7 @@
Less paperwork. More outdoors.

Your club.
Your people.
Your season.

-

A simpler way to keep your hunting club connected, organized, and ready for what’s next.

+

A simpler way to keep your hunting club connected, organized, and ready for what's next.

Verify your email or request another link

@@ -120,7 +120,7 @@ diff --git a/xsl/setupUsers.xsl b/xsl/setupUsers.xsl index 806ef57..64ed1c5 100644 --- a/xsl/setupUsers.xsl +++ b/xsl/setupUsers.xsl @@ -1,5 +1,4 @@ - - + @@ -13,8 +12,8 @@ - - + + @@ -29,7 +28,7 @@
- + | Showing to @@ -82,13 +81,13 @@ Add
- + - + + + +

Administrative notes

+
+ +
NoteUpdatedByAction
+

Login history

  • ·
+ + + diff --git a/xsl/viewJournal.xsl b/xsl/viewJournal.xsl index 3793a25..4ebf7a0 100644 --- a/xsl/viewJournal.xsl +++ b/xsl/viewJournal.xsl @@ -47,7 +47,6 @@
-
@@ -70,7 +69,6 @@ -