dualfroz
23bbaa8c60
The calendar_project_tasks and calendar_user_tasks settings were used as a column name in the iCal query, and escapeIdentifier() leaves values with a space or a dot untouched. A stored value like "1 OR 1=1 OR 1" made the public project feed return tasks from every project. Only date_creation and date_started are accepted now, anything else falls back to date_started. The currency form also stops saving keys other than application_currency, which is how the value could be written in the first place. Fixes #5904
105 lines
3.0 KiB
PHP
105 lines
3.0 KiB
PHP
<?php
|
|
|
|
namespace Kanboard\Controller;
|
|
|
|
/**
|
|
* Currency Controller
|
|
*
|
|
* @package Kanboard\Controller
|
|
* @author Frederic Guillot
|
|
*/
|
|
class CurrencyController extends BaseController
|
|
{
|
|
/**
|
|
* Display all currency rates
|
|
*
|
|
* @access public
|
|
*/
|
|
public function show()
|
|
{
|
|
$this->response->html($this->helper->layout->config('currency/show', array(
|
|
'application_currency' => $this->configModel->get('application_currency'),
|
|
'rates' => $this->currencyModel->getAll(),
|
|
'currencies' => $this->currencyModel->getCurrencies(),
|
|
'title' => t('Settings') . ' > ' . t('Currency rates'),
|
|
)));
|
|
}
|
|
|
|
/**
|
|
* Add or change currency rate
|
|
*
|
|
* @access public
|
|
* @param array $values
|
|
* @param array $errors
|
|
*/
|
|
public function create(array $values = array(), array $errors = array())
|
|
{
|
|
$this->response->html($this->template->render('currency/create', array(
|
|
'values' => $values,
|
|
'errors' => $errors,
|
|
'currencies' => $this->currencyModel->getCurrencies(),
|
|
)));
|
|
}
|
|
|
|
/**
|
|
* Validate and save a new currency rate
|
|
*
|
|
* @access public
|
|
*/
|
|
public function save()
|
|
{
|
|
$values = $this->request->getValues();
|
|
list($valid, $errors) = $this->currencyValidator->validateCreation($values);
|
|
|
|
if ($valid) {
|
|
if ($this->currencyModel->create($values['currency'], $values['rate'])) {
|
|
$this->flash->success(t('The currency rate has been added successfully.'));
|
|
$this->response->redirect($this->helper->url->to('CurrencyController', 'show'), true);
|
|
return;
|
|
} else {
|
|
$this->flash->failure(t('Unable to add this currency rate.'));
|
|
}
|
|
}
|
|
|
|
$this->create($values, $errors);
|
|
}
|
|
|
|
/**
|
|
* Change reference currency
|
|
*
|
|
* @access public
|
|
* @param array $values
|
|
* @param array $errors
|
|
*/
|
|
public function change(array $values = array(), array $errors = array())
|
|
{
|
|
if (empty($values)) {
|
|
$values['application_currency'] = $this->configModel->get('application_currency');
|
|
}
|
|
|
|
$this->response->html($this->template->render('currency/change', array(
|
|
'values' => $values,
|
|
'errors' => $errors,
|
|
'currencies' => $this->currencyModel->getCurrencies(),
|
|
)));
|
|
}
|
|
|
|
/**
|
|
* Save reference currency
|
|
*
|
|
* @access public
|
|
*/
|
|
public function update()
|
|
{
|
|
$values = array_intersect_key($this->request->getValues(), array('application_currency' => ''));
|
|
|
|
if ($this->configModel->save($values)) {
|
|
$this->flash->success(t('Settings saved successfully.'));
|
|
} else {
|
|
$this->flash->failure(t('Unable to save your settings.'));
|
|
}
|
|
|
|
$this->response->redirect($this->helper->url->to('CurrencyController', 'show'), true);
|
|
}
|
|
}
|