人事系统开发
1ba6efd8ed
包含：登录失败锁定、90天密码有效期、30分钟会话超时、 强制改密、登录审计日志、屏幕水印、企业背景图、 备案信息固定底部、favicon、JS空集合保护、 会话过期体验优化（403 JSON）、display_errors 关闭、 固定 key 根治 Integrity check failed 等全部改动 注意：config.inc.php/.htaccess/.user.ini 含敏感信息， 通过 .gitignore 排除，勿推送到公开仓库。
81 lines
2.6 KiB
PHP
81 lines
2.6 KiB
PHP
<?php
|
|
declare(strict_types=1);
|
|
namespace MRBS;
|
|
|
|
use MRBS\Form\Form;
|
|
|
|
|
|
// A page designed to be used in Ajax POST calls for bulk deletion of entries.
|
|
// It takes an array of ids to be deleted as input. These are always assumed
|
|
// to be single entries. Returns the number of entries deleted, or some
|
|
// kind of string on failure (most likely a login page).
|
|
//
|
|
// If deleting lots of entries you may need to split the Ajax requests into
|
|
// multiple smaller requests in order to avoid exceeding the system limit
|
|
// for POST requests, and also the limit on the size of the SQL query once
|
|
// the ids are imploded.
|
|
//
|
|
// Note that:
|
|
// (1) the code assumes that you are an admin with powers to delete anything.
|
|
// It checks that you are an admin and so does not bother checking that
|
|
// you have rights in that particular area or room, nor does it check that
|
|
// the proposed deletion conforms to any policy in force.
|
|
// (2) email notifications are not sent, even if they are normally configured
|
|
// to be sent. Sending many thousands of emails in the space of a few
|
|
// seconds could overwhelm many mail servers, or break the usage policies
|
|
// on hosted systems.
|
|
|
|
require '../defaultincludes.inc';
|
|
require_once '../mrbs_sql.inc';
|
|
|
|
// Check the CSRF token
|
|
Form::checkToken();
|
|
|
|
// Check the user is authorised for this page
|
|
checkAuthorised(this_page());
|
|
|
|
// Check that the user is a booking admin
|
|
if (!is_book_admin())
|
|
{
|
|
exit;
|
|
}
|
|
|
|
// Get non-standard form variables
|
|
$ids = get_form_var('ids', 'string', '[]', INPUT_POST);
|
|
// The ids are JSON encoded to avoid hitting the php.ini max_input_vars limit
|
|
$ids = json_decode($ids);
|
|
|
|
// Check that $ids consists of an array of integers, to guard against SQL injection
|
|
foreach ($ids as $id)
|
|
{
|
|
if (!is_numeric($id) || (intval($id) != $id) || ($id < 0))
|
|
{
|
|
exit;
|
|
}
|
|
}
|
|
|
|
|
|
// Everything looks OK - go ahead and delete the entries
|
|
|
|
// Note on performance. It is much quicker to delete entries using the
|
|
// WHERE id IN method below than looping through mrbsDelEntry(). Testing
|
|
// for 100 entries gave 2.5ms for the IN method against 37.6s for the looping
|
|
// method - ie approx 15 times faster. For 1,000 rows the IN method was 19
|
|
// times faster.
|
|
//
|
|
// Because we are not using mrbsDelEntry() we have to delete any orphaned
|
|
// rows in the repeat table ourselves - but this does not take long.
|
|
|
|
$sql = "DELETE FROM " . _tbl('entry') . "
|
|
WHERE id IN (" . implode(',', $ids) . ")";
|
|
$result = db()->command($sql);
|
|
|
|
// And delete any orphaned rows in the repeat table
|
|
$sql = "DELETE FROM " . _tbl('repeat') . "
|
|
WHERE id NOT IN (SELECT repeat_id FROM " . _tbl('entry') . ")";
|
|
$orphan_result = db()->command($sql);
|
|
|
|
|
|
echo $result;
|
|
|