Thomas/Piwigo_Bratonien_Tools
1
0
Fork 0
mirror of https://github.com/Terranom674/Piwigo_Bratonien_Tools.git synced 2026-09-20 13:23:20 +00:00
Code Issues Packages Projects Releases Wiki Activity

Harden customer QR batch form validation

Browse Source
This commit is contained in:
Terranom674
2026-09-05 15:45:12 +02:00
parent a386c71c3c
commit 289eea396e
1 changed files with 15 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
customer-qr-upload.php
View File

@@ -62,6 +62,15 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST')
try try
{ {
if (
empty($_POST)
&& empty($_FILES)
&& !empty($_SERVER['CONTENT_LENGTH'])
)
{
throw new RuntimeException('Der Upload überschreitet das PHP-Limit post_max_size ('.ini_get('post_max_size').').');
}
if (function_exists('check_pwg_token')) if (function_exists('check_pwg_token'))
{ {
check_pwg_token(); check_pwg_token();
@@ -69,15 +78,6 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST')
$year = bratonien_tools_customer_qr_year($_POST['upload_year'] ?? ''); $year = bratonien_tools_customer_qr_year($_POST['upload_year'] ?? '');
if (
empty($_FILES['qr_files'])
&& empty($_POST)
&& !empty($_SERVER['CONTENT_LENGTH'])
)
{
throw new RuntimeException('Der Upload überschreitet das PHP-Limit post_max_size ('.ini_get('post_max_size').').');
}
if (empty($_FILES['qr_files'])) if (empty($_FILES['qr_files']))
{ {
throw new RuntimeException('Es wurden keine QR-Code-Dateien ausgewählt.'); throw new RuntimeException('Es wurden keine QR-Code-Dateien ausgewählt.');
@@ -121,7 +121,7 @@ $selected_year = isset($flash['year']) ? (int)$flash['year'] : bratonien_tools_c
$results = isset($flash['results']) && is_array($flash['results']) ? $flash['results'] : array(); $results = isset($flash['results']) && is_array($flash['results']) ? $flash['results'] : array();
$token = function_exists('get_pwg_token') ? get_pwg_token() : ''; $token = function_exists('get_pwg_token') ? get_pwg_token() : '';
$max_files = max(1, (int)ini_get('max_file_uploads')); $max_files = max(1, (int)ini_get('max_file_uploads'));
$endpoint = htmlspecialchars(strtok($_SERVER['REQUEST_URI'], '?'), ENT_QUOTES, 'UTF-8'); $endpoint = strtok($_SERVER['REQUEST_URI'], '?');
header('Content-Type: text/html; charset=utf-8'); header('Content-Type: text/html; charset=utf-8');
header('Cache-Control: no-store, max-age=0'); header('Cache-Control: no-store, max-age=0');
@@ -284,6 +284,8 @@ header('Cache-Control: no-store, max-age=0');
timers.set(row,window.setTimeout(function(){checkRow(row);},250)); timers.set(row,window.setTimeout(function(){checkRow(row);},250));
} }
function scheduleAll(){rows().forEach(function(row){scheduleCheck(row);});}
function rebuild(){ function rebuild(){
list.textContent=''; list.textContent='';
Array.prototype.slice.call(fileInput.files||[]).forEach(function(file,index){ Array.prototype.slice.call(fileInput.files||[]).forEach(function(file,index){
@@ -292,17 +294,17 @@ header('Cache-Control: no-store, max-age=0');
var input=document.createElement('input');input.type='text';input.name='qr_numbers[]';input.inputMode='numeric';input.autocomplete='off';input.placeholder='QR-Nummer';input.setAttribute('aria-label','QR-Code-Nummer für '+file.name);input.maxLength=32;input.required=true; var input=document.createElement('input');input.type='text';input.name='qr_numbers[]';input.inputMode='numeric';input.autocomplete='off';input.placeholder='QR-Nummer';input.setAttribute('aria-label','QR-Code-Nummer für '+file.name);input.maxLength=32;input.required=true;
var status=document.createElement('div');status.className='status';status.textContent='Nummer fehlt.'; var status=document.createElement('div');status.className='status';status.textContent='Nummer fehlt.';
row.appendChild(name);row.appendChild(input);row.appendChild(status);list.appendChild(row); row.appendChild(name);row.appendChild(input);row.appendChild(status);list.appendChild(row);
input.addEventListener('input',function(){scheduleCheck(row);}); input.addEventListener('input',scheduleAll);
if(index===0)window.setTimeout(function(){input.focus();},0); if(index===0)window.setTimeout(function(){input.focus();},0);
}); });
updateSubmit(); updateSubmit();
} }
fileInput.addEventListener('change',rebuild); fileInput.addEventListener('change',rebuild);
yearInput.addEventListener('change',function(){rows().forEach(function(row){scheduleCheck(row);});}); yearInput.addEventListener('change',scheduleAll);
form.addEventListener('submit',function(event){ form.addEventListener('submit',function(event){
var invalid=rows().some(function(row){return row.dataset.valid!=='1';}); var invalid=rows().some(function(row){return row.dataset.valid!=='1';});
if(invalid){event.preventDefault();rows().forEach(function(row){if(row.dataset.valid!=='1')checkRow(row);});} if(invalid){event.preventDefault();scheduleAll();}
else{submit.disabled=true;submit.textContent='Upload läuft …';} else{submit.disabled=true;submit.textContent='Upload läuft …';}
}); });
})(); })();