MRBS 1.12.2 等保2.0二级整改完整提交

包含：登录失败锁定、90天密码有效期、30分钟会话超时、
强制改密、登录审计日志、屏幕水印、企业背景图、
备案信息固定底部、favicon、登录页JS修复等全部改动

web/ajax/del_entries.php

@@ -0,0 +1,80 @@
+<?php
+declare(strict_types=1);
+namespace MRBS;
+
+use MRBS\Form\Form;
+
+
+// A page designed to be used in Ajax POST calls for bulk deletion of entries.
+// It takes an array of ids to be deleted as input.   These are always assumed
+// to be single entries.   Returns the number of entries deleted, or some
+// kind of string on failure (most likely a login page).
+//
+// If deleting lots of entries you may need to split the Ajax requests into
+// multiple smaller requests in order to avoid exceeding the system limit
+// for POST requests, and also the limit on the size of the SQL query once
+// the ids are imploded.
+//
+// Note that:
+// (1) the code assumes that you are an admin with powers to delete anything.
+//     It checks that you are an admin and so does not bother checking that
+//     you have rights in that particular area or room, nor does it check that
+//     the proposed deletion conforms to any policy in force.
+// (2) email notifications are not sent, even if they are normally configured
+//     to be sent.   Sending many thousands of emails in the space of a few
+//     seconds could overwhelm many mail servers, or break the usage policies
+//     on hosted systems.
+
+require '../defaultincludes.inc';
+require_once '../mrbs_sql.inc';
+
+// Check the CSRF token
+Form::checkToken();
+
+// Check the user is authorised for this page
+checkAuthorised(this_page());
+
+// Check that the user is a booking admin
+if (!is_book_admin())
+{
+  exit;
+}
+
+// Get non-standard form variables
+$ids = get_form_var('ids', 'string', '[]', INPUT_POST);
+// The ids are JSON encoded to avoid hitting the php.ini max_input_vars limit
+$ids = json_decode($ids);
+
+// Check that $ids consists of an array of integers, to guard against SQL injection
+foreach ($ids as $id)
+{
+  if (!is_numeric($id) || (intval($id) != $id) || ($id < 0))
+  {
+    exit;
+  }
+}
+
+
+// Everything looks OK - go ahead and delete the entries
+
+// Note on performance.   It is much quicker to delete entries using the
+// WHERE id IN method below than looping through mrbsDelEntry().  Testing
+// for 100 entries gave 2.5ms for the IN method against 37.6s for the looping
+// method - ie approx 15 times faster.   For 1,000 rows the IN method was 19
+// times faster.
+//
+// Because we are not using mrbsDelEntry() we have to delete any orphaned
+// rows in the repeat table ourselves - but this does not take long.
+
+$sql = "DELETE FROM " . _tbl('entry') . "
+         WHERE id IN (" . implode(',', $ids) . ")";
+$result = db()->command($sql);
+
+// And delete any orphaned rows in the repeat table
+$sql = "DELETE FROM " . _tbl('repeat') . "
+         WHERE id NOT IN (SELECT repeat_id FROM " . _tbl('entry') . ")";
+$orphan_result = db()->command($sql);
+
+
+echo $result;
+