field escaping

[confetti] / cards / update_card.sh

diff --git a/cards/update_card.sh b/cards/update_card.sh
index a1143c3d72057359ef7b42a07c919c3d21ef33f4..c2b972069011faf5ff47d160259a4f70e5188255 100755 (executable)
--- a/cards/update_card.sh
+++ b/cards/update_card.sh
@@ -1,6 +1,6 @@
 #!/bin/zsh
 
-# Copyright 2014, 2016 Paul Hänsch
+# Copyright 2014, 2016, 2019 Paul Hänsch
 #
 # This file is part of Confetti.
 # 
@@ -17,86 +17,94 @@
 # You should have received a copy of the GNU Affero General Public License
 # along with Confetti.  If not, see <http://www.gnu.org/licenses/>. 
 
-cgi_refdata
+. "$_EXEC/pdiread.sh"
+. "$_EXEC/session_lock.sh"
 
-filter="&filter=${_REF[filter]}"
-filtertype="&filtertype=${_REF[filtertype]}"
-order="&order=${_REF[order]}"
+filter="$(REF f)"
+order="$(REF o)"
 
-card="${_POST[card]}"
-tempfile="$_DATA/temp/$card"
+card="$(POST card)"
 cardfile="$_DATA/vcard/$card"
 attfile="$_DATA/mappings/attendance"
 
+if ! tempfile=$(CHECK_SLOCK "$cardfile"); then
+  SET_COOKIE 0 message="NO VALID FILE LOCK"
+  REDIRECT "/cards/?o=${order}&f=${filter}&e=${card}"
+  exit 0
+elif [ "$(POST tid)" != "$(transid "$tempfile")" ]; then
+  SET_COOKIE 0 message="INVALID TRANSACTION ID"
+  REDIRECT "/cards/?o=${order}&f=${filter}&e=${card}"
+  exit 0
+fi
+
 vcf_escape(){
   for each in "$@"; do
     printf %s\\n "$each" \
-    | sed -r ':X;$!{N;bX}; s;\r\n;\n;g; s;([;,\\]);\\\1;g; s;\n;\\n;g;'
+    | sed -E ':X;$!{N;bX}; s;\r\n;\n;g; s;([;,\\]);\\\1;g; s;\n;\\n;g;'
   done \
-  | sed -r ':X;$!{N;bX}; s;\n;\;;g'
+  | sed -E ':X;$!{N;bX}; s;\n;\;;g'
 }
 
-[ "${_POST[hi_select]}" = "list" ] || _POST[hi_company]="${_POST[hi_other]}"
-[ -n "${_POST[hi_company]}${_POST[hi_number]}${_POST[hi_status]}" ] \
-&& _POST[X-HEALTH-INSURANCE]="$(vcf_escape "${_POST[hi_company]}" "${_POST[hi_number]}" "${_POST[hi_status]}")"
+# [ "${_POST[hi_select]}" = "list" ] || _POST[hi_company]="${_POST[hi_other]}"
+# [ -n "${_POST[hi_company]}${_POST[hi_number]}${_POST[hi_status]}" ] \
+# && _POST[X-HEALTH-INSURANCE]="$(vcf_escape "${_POST[hi_company]}" "${_POST[hi_number]}" "${_POST[hi_status]}")"
 
-sed -r 's;$;\r;' >"$tempfile" <<EOF
-BEGIN:VCARD
-VERSION:4.0
-N:$(vcf_escape "${_POST[0N]}" "${_POST[1N]}" "${_POST[2N]}" "${_POST[3N]}" "${_POST[4N]}")
-UID:${_POST[UID]}
-$(
-  for field in $VCF_FIELDS; do for key in $field $field{0..100}; do
-    [ -z "${_POST[$key]+x}" ] && break
-    [ -z "${_POST[$key]}" ] && continue
-    case "$key" in
-      (TEL[0-9]*)
-        printf '%s;TYPE=%s:%s\r\n' "${field}" "${_POST[phonetype${key#TEL}]}" "$(vcf_escape "${_POST[$key]}")"
-        ;;
-      (X-HEALTH-INSURANCE)
-        printf '%s:%s\r\n' "${field}" "${_POST[$key]}"
-        ;;
-      (*)
-        printf '%s:%s\r\n' "${field}" "$(vcf_escape "${_POST[$key]}")"
+vcf="$(pdi_load "$cardfile")"
+
+vcf="$(pdi_update_value "$vcf" N 1 "$(vcf_escape "$(POST 1N)" "$(POST 2N)" "$(POST 3N)" "$(POST 4N)" "$(POST 5N)")")"
+
+for field in $(POST_KEYS |grep -xE '[A-Z][A-Z0-9-]*'); do
+  for cnt in $(seq 1 $(POST_COUNT "$field")); do
+    case "$field" in
+      # (TEL)
+      #   printf '%s;TYPE=%s:%s\r\n' "${field}" "${_POST[phonetype${key#TEL}]}" "$(vcf_escape "$(POST "$field" "$cnt")")"
+      #   ;;
+      TEL)
+         vcf="$(pdi_update_attrib "$vcf" TEL $cnt TYPE="$(POST teltype $cnt |grep -Exm1 'HOME|WORK|CELL|FAX')")"
+         vcf="$(pdi_update_value "$vcf" "$field" "$cnt" "$(vcf_escape "$(POST "$field" "$cnt")")")"
+         ;;
+      *)
+         vcf="$(pdi_update_value "$vcf" "$field" "$cnt" "$(vcf_escape "$(POST "$field" "$cnt")")")"
         ;;
     esac
-  done; done
-  [ "${_POST[action]}" = addfield ] && printf '%s:\r\n' "${_POST[newfield]}"
-)
-END:VCARD
-EOF
+done; done
+[ "$(POST action)" = addfield ] && vcf="$(vcf_update_field "$vcf" "$(POST newfield)" $(($(pdi_count $(POST newfield)) + 1)) '')"
+
+printf '%s' "$vcf" |grep -vx '' >"$tempfile"
 
-case "${_POST[action]}" in
+case "$(POST action)" in
   addfield)
-    redirect "?p=cards${filter}${filtertype}${order}&edit=$card"
+    REDIRECT "/cards/?o=${order}&f=${filter}&e=${card}"
     ;;
   update)
-    attendance=()
-    for att in attendance attendance{0..100}; do
-      [ -n "${_POST[$att]}" ] && attendance+=("${_POST[$att]}")
-    done
-    sed -rn 's:^(.+)'$card'$:\1:p' "$attfile" |while read course; do
-      touch "$_DATA/ical/$course"
-    done
-    sed -i -r '/^(.+)\t'$card'$/d' "$attfile"
-    for each in $attendance; do
-      echo "$each\t$card"
-    done >>"$attfile"
-    sed -rn 's:^(.+)'$card'$:\1:p' "$attfile" |while read course; do
-      touch "$_DATA/ical/$course"
-    done
+    # attendance=()
+    # for att in attendance attendance{0..100}; do
+    #   [ -n "${_POST[$att]}" ] && attendance+=("${_POST[$att]}")
+    # done
+    # sed -rn 's:^(.+)'$card'$:\1:p' "$attfile" |while read course; do
+    #   touch "$_DATA/ical/$course"
+    # done
+    # sed -i -r '/^(.+)\t'$card'$/d' "$attfile"
+    # for each in $attendance; do
+    #   echo "$each\t$card"
+    # done >>"$attfile"
+    # sed -rn 's:^(.+)'$card'$:\1:p' "$attfile" |while read course; do
+    #   touch "$_DATA/ical/$course"
+    # done
 
-    mv "$tempfile" "$cardfile"
-    redirect "?p=cards${filter}${filtertype}${order}#$card"
+    cp "$tempfile" "$cardfile"
+    RELEASE_SLOCK "$cardfile"
+    REDIRECT "/cards/?o=${order}&f=${filter}#${card}"
     ;;
   cancel)
-    rm "$tempfile"
+    RELEASE_SLOCK "$cardfile"
     [ -f "$cardfile" ] \
-    && redirect "?p=cards${filter}${filtertype}${order}#$card" \
-    || redirect "?p=cards${filter}${filtertype}${order}"
+    && REDIRECT "/cards/?o=${order}&f=${filter}#${card}" \
+    || REDIRECT "/cards/?o=${order}&f=${filter}"
     ;;
   delete)
-    rm "$tempfile" "$cardfile"
-    redirect "?p=cards${filter}${filtertype}${order}"
+    rm "$cardfile"
+    RELEASE_SLOCK "$cardfile"
+    REDIRECT "/cards/?o=${order}&f=${filter}"
     ;;
 esac