adminandClaude Opus 5
768520cedd
actorDetails.php, sensorDetails.php, fillActorDD.php und fillSensorDD.php fragten die homeMesh-Datenbank ab und gaben Geraetenamen samt Steuer-URLs (command_url, command_parameters.url) aus - ohne jede Zugriffspruefung. Alle vier pruefen jetzt checkLogin(), bevor sie etwas ausgeben. Aufgerufen werden sie ausschliesslich aus js/solar/autoActionFuncs.js auf der Home-Seite, also aus einer angemeldeten Sitzung; der Regeleditor funktioniert unveraendert. Die SQL war bereits sauber (intval), es fehlte nur die Autorisierung. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
88 lines
3.4 KiB
PHP
88 lines
3.4 KiB
PHP
<?php
|
|
require_once("../helper.php");
|
|
|
|
// Der Endpunkt gibt Geraetenamen und Steuer-URLs aus der homeMesh-
|
|
// Datenbank aus und war bisher ohne Anmeldung erreichbar.
|
|
if (!checkLogin()) {
|
|
http_response_code(403);
|
|
exit;
|
|
}
|
|
if(isset($_GET["actorID"])){
|
|
$actorID = intval($_GET["actorID"]);
|
|
$qry = "SELECT command_name, command_url, parameter_type, min_value, max_value, possible_values, command_parameters.url AS parameter_url, parameter_name FROM actor_commands LEFT JOIN command_parameters ON actor_commands.id = command_id LEFT JOIN state_types ON parameter_type = state_types.id WHERE actor_id=".$actorID;
|
|
$qry = "SELECT id, command_name, command_url FROM actor_commands WHERE actor_id = ".$actorID;
|
|
$mysql = new mysqli($mysql_server, $mysql_MeshUser, $mysql_MeshPass, $mysql_MeshDB);
|
|
$result = mysqli_query($mysql, $qry);
|
|
$operators = "";
|
|
//while($row = $result->fetch_assoc()){
|
|
// print_r($row);
|
|
// echo "<br />";
|
|
//}
|
|
echo '{"commands": [';
|
|
$iterated = 0;
|
|
while($row = $result->fetch_assoc()){
|
|
$items = "[]";
|
|
$qry2 = "SELECT parameter_type, min_value, max_value, possible_values, command_parameters.url AS parameter_url, parameter_name FROM actor_commands LEFT JOIN command_parameters ON actor_commands.id = command_id LEFT JOIN state_types ON parameter_type = state_types.id WHERE command_id = ".$row["id"];
|
|
$result2 = mysqli_query($mysql, $qry2);
|
|
if($iterated++){
|
|
echo ", ";
|
|
}
|
|
echo '{"name" : "'.$row["command_name"].'", "operators" : ["="], "parameters": [';
|
|
$iterated2 = 0;
|
|
$type = "hidden";
|
|
while($row2 = $result2->fetch_assoc()){
|
|
switch($row2["parameter_type"]){
|
|
case "integer":
|
|
if($row2["possible_values"]){
|
|
$items = $row2["possible_values"];
|
|
$type = "dropdown";
|
|
}else{
|
|
$type = "number";
|
|
}
|
|
break;
|
|
case "float":
|
|
$type = "number";
|
|
break;
|
|
case "time":
|
|
$type = "time";
|
|
break;
|
|
case "bool":
|
|
$type = "button";
|
|
break;
|
|
case "string":
|
|
if($row2["possible_values"]){
|
|
$items = $row2["possible_values"];
|
|
$type = "dropdown";
|
|
}else{
|
|
$type = "text";
|
|
}
|
|
break;
|
|
case "":
|
|
$type = "hidden";
|
|
default:
|
|
$type = "text";
|
|
break;
|
|
}
|
|
if($iterated2++){
|
|
echo ", ";
|
|
}
|
|
echo '{"name" : "'.$row2["parameter_name"].'", "url" : "'.$row2["parameter_url"].'", "type" : "'.$type.'", "options" : '.$items.'}';
|
|
}
|
|
echo '], "type" : "'.$type.'"}';
|
|
}
|
|
echo "]}";
|
|
}
|
|
|
|
|
|
/*
|
|
require_once("../helper.php");
|
|
if(isset($_GET["actorID"])){
|
|
$ID = intval($_GET["actorID"]);
|
|
$qry = "SELECT parameters FROM actors WHERE id=".$ID;
|
|
$mysql = new mysqli($mysql_server, $mysql_solarUser, $mysql_solarPass, $mysql_solarDB);
|
|
$result = mysqli_query($mysql, $qry);
|
|
echo $result->fetch_array()[0];
|
|
}
|
|
|
|
*/
|
|
?>
|