diff options
Diffstat (limited to 'public/app/controllers/Office.php')
| -rw-r--r-- | public/app/controllers/Office.php | 71 |
1 files changed, 61 insertions, 10 deletions
diff --git a/public/app/controllers/Office.php b/public/app/controllers/Office.php index 800247e..9ff4e14 100644 --- a/public/app/controllers/Office.php +++ b/public/app/controllers/Office.php @@ -6,7 +6,7 @@ use Registry; use Render; use app\controllers\Auth; use app\extends\App_manager; -use app\models\Cms_model; +use app\models\Content_model; use app\extends\Cache_service; /** Office class @@ -112,10 +112,13 @@ class Office { - ## PETITIONS - ## ------------------------------------------------------------------------- - ## secretarial support / teachers' requests and applications + ## ------------------------------------------------------------------------- + ## + ## PETITION FORMS + ## secretarial support / serve forms for teachers' requests and applications + ## + ## ------------------------------------------------------------------------- /** request any (empty/new) petition form @@ -200,7 +203,7 @@ class Office { ]); // #5: create ticket; then render the view ----------------------------- - $ticket = self::create_ticket($ticket); // save ticket + $ticket = self::create_ticket(); // save ticket Render::view('templates/application', [ 'form' => $form, 'applier' => (($userData['prefix'] == 'η') ? 'Η Αιτούσα' : 'Ο Αιτών'), @@ -263,12 +266,55 @@ class Office { ## ------------------------------------------------------------------------- ## + ## PETITION SUBMITS + ## handle submits of forms + ## + ## ------------------------------------------------------------------------- + + + /** add_petition + * + * handle an add petition request (petition form is submited) + * + * @param void; all params are readed from POST, Auth and SESSION + * @return int new petition-id + */ + public static function add_petition() + { + $post = Registry::get('REQUEST')->POST; + + + if (self::remove_ticket($post['ticket'])) { // check ticket + remove + + $manager = new App_manager(); + + $new_id = Content_model::add_petition([ + 'user_id' => $manager->getUserToken()->getUser()->getID(), + 'type_id' => $post['type_id'], + 'subject' => $post['subject'], + 'signature' => $post['ticket'], + 'form_structure' => serialize($post) + ]); + + Render::json([ + 'success' => true, + 'id' => $new_id + ]); + + } else { + Render::json(['success' => false, 'error' => TICKET_EXPIRED]); + } + } + + + + ## ------------------------------------------------------------------------- + ## ## TICKET METHODS (create, remove) ## tickets eliminate CSRF attacks ## ## ------------------------------------------------------------------------- - /** create_ticket * * creates a tickef and saves it into session @@ -278,24 +324,29 @@ class Office { private static function create_ticket() { // create ticket - $tick = md5( time() . Auth::user_data() . rand(1,65536) ); + $tick = md5( time() . json_encode(Auth::user_data()) . rand(1,65536) ); // then save to session if (isset($_SESSION['tickets'])) { $tickets = explode(',', $_SESSION['tickets']); - $tickets[] = $tick; + + if (count($tickets) > 99) { // if more than 99 tickets + array_shift($tickets); // remove the older + } + $tickets[] = $tick; // add new ticket to the tickets list $_SESSION['tickets'] = implode(',', $tickets); } else { $_SESSION['tickets'] = $tick; } - return $tick; + return $tick; // return the xreated ticket } + /** remove_ticker * * removes a ticket and return true; - * if ticket not exists return fase; + * NOTE: if ticket not exists return false; * * @param string $t : ticket (MD5) * @return boolean |