mirror of
https://github.com/itflow-org/itflow
synced 2026-08-05 15:17:17 +00:00
142 lines
5.1 KiB
PHP
142 lines
5.1 KiB
PHP
<?php
|
|
|
|
|
|
// Variable assignment from POST (or: blank/from DB is updating)
|
|
|
|
/*
|
|
* There is no form behind the API, so nothing has capped these before they arrive.
|
|
* An overlong value is a hard MySQL error, not a truncation, so it would surface as a
|
|
* generic "insert query failed" - say what actually went wrong instead.
|
|
* Only the fields present are checked, which keeps partial updates working.
|
|
*/
|
|
$credential_field_too_long = checkCredentialLengths([
|
|
'name' => $_POST['credential_name'] ?? null,
|
|
'description' => $_POST['credential_description'] ?? null,
|
|
'uri' => $_POST['credential_uri'] ?? null,
|
|
'uri_2' => $_POST['credential_uri_2'] ?? null,
|
|
'username' => $_POST['credential_username'] ?? null,
|
|
'password' => $_POST['credential_password'] ?? null,
|
|
'otp_secret' => $_POST['credential_otp_secret'] ?? null,
|
|
]);
|
|
|
|
if ($credential_field_too_long) {
|
|
$return_arr['success'] = "False";
|
|
$return_arr['message'] = "credential_$credential_field_too_long is too long to store.";
|
|
echo json_encode($return_arr);
|
|
exit();
|
|
}
|
|
|
|
$api_key_decrypt_password = '';
|
|
if (isset($_POST['api_key_decrypt_password'])) {
|
|
$api_key_decrypt_password = $_POST['api_key_decrypt_password']; // No sanitization
|
|
}
|
|
|
|
if (isset($_POST['credential_name'])) {
|
|
$name = escapeSql($_POST['credential_name']);
|
|
} elseif (isset($credential_row) && isset($credential_row['credential_name'])) {
|
|
$name = mysqli_real_escape_string($mysqli, $credential_row['credential_name']);
|
|
} else {
|
|
$name = '';
|
|
}
|
|
|
|
if (isset($_POST['credential_description'])) {
|
|
$description = escapeSql($_POST['credential_description']);
|
|
} elseif (isset($credential_row) && isset($credential_row['credential_description'])) {
|
|
$description = mysqli_real_escape_string($mysqli, $credential_row['credential_description']);
|
|
} else {
|
|
$description = '';
|
|
}
|
|
|
|
if (isset($_POST['credential_uri'])) {
|
|
$uri = escapeSql($_POST['credential_uri']);
|
|
} elseif (isset($credential_row) && isset($credential_row['credential_uri'])) {
|
|
$uri = mysqli_real_escape_string($mysqli, $credential_row['credential_uri']);
|
|
} else {
|
|
$uri = '';
|
|
}
|
|
|
|
if (isset($_POST['credential_uri_2'])) {
|
|
$uri_2 = escapeSql($_POST['credential_uri_2']);
|
|
} elseif (isset($credential_row) && isset($credential_row['credential_uri_2'])) {
|
|
$uri_2 = mysqli_real_escape_string($mysqli, $credential_row['credential_uri_2']);
|
|
} else {
|
|
$uri_2 = '';
|
|
}
|
|
|
|
if (isset($_POST['credential_username'])) {
|
|
$username = $_POST['credential_username'];
|
|
$username = apiEncryptCredentialEntry($username, $api_key_decrypt_hash, $api_key_decrypt_password);
|
|
} elseif (isset($credential_row) && isset($credential_row['credential_username'])) {
|
|
$username = $credential_row['credential_username'];
|
|
} else {
|
|
$username = '';
|
|
}
|
|
|
|
if (isset($_POST['credential_password'])) {
|
|
$password = $_POST['credential_password'];
|
|
$password = apiEncryptCredentialEntry($password, $api_key_decrypt_hash, $api_key_decrypt_password);
|
|
$password_changed = true;
|
|
} elseif (isset($credential_row) && isset($credential_row['credential_password'])) {
|
|
$password = $credential_row['credential_password'];
|
|
$password_changed = false;
|
|
} else {
|
|
$password = '';
|
|
$password_changed = false;
|
|
}
|
|
|
|
if (isset($_POST['credential_otp_secret'])) {
|
|
$otp_secret = escapeSql($_POST['credential_otp_secret']);
|
|
} elseif (isset($credential_row) && isset($credential_row['credential_otp_secret'])) {
|
|
$otp_secret = mysqli_real_escape_string($mysqli, $credential_row['credential_otp_secret']);
|
|
} else {
|
|
$otp_secret = '';
|
|
}
|
|
|
|
if (isset($_POST['credential_note'])) {
|
|
$note = escapeSql($_POST['credential_note']);
|
|
} elseif (isset($credential_row) && isset($credential_row['credential_note'])) {
|
|
$note = mysqli_real_escape_string($mysqli, $credential_row['credential_note']);
|
|
} else {
|
|
$note = '';
|
|
}
|
|
|
|
if (isset($_POST['credential_favorite'])) {
|
|
$favorite = intval($_POST['credential_favorite']);
|
|
} elseif (isset($credential_row) && isset($credential_row['credential_favorite'])) {
|
|
$favorite = $credential_row['credential_favorite'];
|
|
} else {
|
|
$favorite = 0;
|
|
}
|
|
|
|
if (isset($_POST['credential_contact_id'])) {
|
|
$contact_id = intval($_POST['credential_contact_id']);
|
|
} elseif (isset($credential_row) && isset($credential_row['credential_contact_id'])) {
|
|
$contact_id = $credential_row['credential_contact_id'];
|
|
} else {
|
|
$contact_id = 0;
|
|
}
|
|
|
|
if (isset($_POST['credential_vendor_id'])) {
|
|
$vendor_id = intval($_POST['credential_vendor_id']);
|
|
} elseif (isset($credential_row) && isset($credential_row['credential_vendor_id'])) {
|
|
$vendor_id = $credential_row['credential_vendor_id'];
|
|
} else {
|
|
$vendor_id = 0;
|
|
}
|
|
|
|
if (isset($_POST['credential_asset_id'])) {
|
|
$asset_id = intval($_POST['credential_asset_id']);
|
|
} elseif (isset($credential_row) && isset($credential_row['credential_asset_id'])) {
|
|
$asset_id = $credential_row['credential_asset_id'];
|
|
} else {
|
|
$asset_id = 0;
|
|
}
|
|
|
|
if (isset($_POST['credential_software_id'])) {
|
|
$software_id = intval($_POST['credential_software_id']);
|
|
} elseif (isset($credential_row) && isset($credential_row['credential_software_id'])) {
|
|
$software_id = $credential_row['credential_software_id'];
|
|
} else {
|
|
$software_id = 0;
|
|
}
|