Add reset/check for query call count

Whenever a query is executed without the db_return method and it is a
select query, then it is counted and if it is over a max value it will
return false and terminate.

With those functions that counter value can be checked and reset.

To be used carefully. It is recommended to rather make often called
queries with the same values prepare/execute style instead of resetting
the count.

4dev/database/table/edit_user.sql

@@ -21,6 +21,13 @@ CREATE TABLE edit_user (
 	edit_group_id INT NOT NULL,
 	edit_scheme_id INT,
 	edit_access_right_id INT NOT NULL,
+	login_error_count	INT,
+	login_error_date_last	TIMESTAMP WTIHOUT TIME ZONE,
+	login_error_date_first	TIMESTAMP WTIHOUT TIME ZONE,
+	strict	SMALLINT DEFAULT 0,
+	locked	SMALLINT DEFAULT 0,
+	password_change_date	TIMESTAMP WITHOUT TIME ZONE, -- only when password is first set or changed
+	password_change_interval	INTERVAL, -- null if no change is needed, or d/m/y time interval
 	FOREIGN KEY (edit_language_id) REFERENCES edit_language (edit_language_id) MATCH FULL ON DELETE CASCADE ON UPDATE CASCADE,
 	FOREIGN KEY (edit_group_id) REFERENCES edit_group (edit_group_id) MATCH FULL ON DELETE CASCADE ON UPDATE CASCADE,
 	FOREIGN KEY (edit_scheme_id) REFERENCES edit_scheme (edit_scheme_id) MATCH FULL ON DELETE CASCADE ON UPDATE CASCADE,

4dev/update/20140822_edit_update/edit_tables.sql

@@ -0,0 +1,11 @@
+-- update edit tables
+-- add login error count and last login error
+
+-- count login errors
+ALTER TABLE edit_user ADD login_error_count INT DEFAULT 0;
+-- last login error date
+ALTER TABLE edit_user ADD login_error_date_last TIMESTAMP WITHOUT TIME ZONE;
+ALTER TABLE edit_user ADD login_error_date_first TIMESTAMP WITHOUT TIME ZONE;
+-- if this is set to true, this user gets locked after max login errors are reached
+ALTER TABLE edit_user ADD strict SMALLINT DEFAULT 0;
+ALTER TABLE edit_user ADD locked SMALLINT DEFAULT 0;

www/admin/edit_base.inc

@@ -222,12 +222,18 @@
 		switch ($form->my_page_name)
 		{
 			case "edit_users":
+				$elements[] = $form->form_create_element("login_error_count");
+				$elements[] = $form->form_create_element("login_error_date_last");
+				$elements[] = $form->form_create_element("login_error_date_first");
 				$elements[] = $form->form_create_element("enabled");
 				$elements[] = $form->form_create_element("username");
 				$elements[] = $form->form_create_element("password");
+				$elements[] = $form->form_create_element("password_change_interval");
 				$elements[] = $form->form_create_element("email");
 				$elements[] = $form->form_create_element("edit_group_id");
 				$elements[] = $form->form_create_element("edit_access_right_id");
+				$elements[] = $form->form_create_element("strict");
+				$elements[] = $form->form_create_element("locked");
 				$elements[] = $form->form_create_element("admin");
 				$elements[] = $form->form_create_element("debug");
 				$elements[] = $form->form_create_element("db_debug");
@@ -253,7 +259,7 @@
 					for ($i = 0; $i < count($output); $i ++)
 					{
 						$t_q = "('".$form->db_escape_string($output[$i])."')";
-						$form->db_exec($q.$t_q);
+						$form->db_exec($q.$t_q, 'NULL');
 					}
 					$elements[] = $form->form_create_element("filename");
 				}
@@ -315,7 +321,6 @@
 
 	// debug data, if DEBUG flag is on, this data is print out
 	$DEBUG_DATA['DEBUG'] = $DEBUG_TMPL;
-	$DEBUG_DATA['Id'] = '$Id: edit_base.inc 4897 2014-02-06 08:16:56Z gullevek $';
 
 	// create main data array
 	$CONTENT_DATA = array_merge($HEADER, $DATA, $DEBUG_DATA);

www/admin/edit_order.php

@@ -29,7 +29,6 @@
 	// set session name
 	define('SET_SESSION_NAME', EDIT_SESSION_NAME);
 	require(LIBS."Class.Login.inc");
-	require(LIBS."Class.DB.IO.inc");
 	require(LIBS.'Class.Smarty.Extend.inc');
 
 	// default lang
@@ -195,7 +194,6 @@
 
 	// debug data, if DEBUG flag is on, this data is print out
 	$DEBUG_DATA['DEBUG'] = $DEBUG_TMPL;
-	$DEBUG_DATA['Id'] = '$Id: edit_order.php 4897 2014-02-06 08:16:56Z gullevek $';
 
 	// create main data array
 	$CONTENT_DATA = array_merge($HEADER, $DATA, $DEBUG_DATA);

www/admin/files.php

@@ -475,10 +475,6 @@ $cms->debug('file_upload', "ERROR: $error | INI FSize: ".ini_get("upload_max_fil
 
 	//------------------------------ processing data end
 
-	//------------------------------ debug data
-	$DEBUG_DATA['Id'] = '$Id: files.php 4897 2014-02-06 08:16:56Z gullevek $';
-	//------------------------------ debug data
-
 	//------------------------------ smarty start
 	require("smarty.inc");
 	//------------------------------ smarty end

www/admin/smarty.inc

@@ -86,7 +86,6 @@
 	// debug data, if DEBUG flag is on, this data is print out
 	$cms->DEBUG_DATA['debug_error_msg'] = $cms->running_time();
 	$cms->DEBUG_DATA['DEBUG'] = $DEBUG_TMPL;
-	$cms->DEBUG_DATA['Id'] = '$Id: smarty.inc 4897 2014-02-06 08:16:56Z gullevek $';
 
 	// create main data array
 	$cms->CONTENT_DATA = array_merge($cms->HEADER, $cms->DATA, $cms->DEBUG_DATA);

www/admin/table_arrays/array_edit_users.inc

@@ -11,7 +11,7 @@
 				"value" => $GLOBALS["username"], 
 				"output_name" => "Username", 
 				"mandatory" => 1, 
-				"error_check" => "unique|alphanumeric",
+				"error_check" => "unique|alphanumericextended",
 				"type" => "text"
 			),
 			"password" => array (
@@ -20,8 +20,24 @@
 				"CONFIRM_value" => $GLOBALS["CONFIRM_password"],
 				"output_name" => "Password", 
 				"mandatory" => 1, 
-				"type" => "password" // later has to be password for encryption in database
+				"type" => "password", // later has to be password for encryption in database
+				'update' => array ( // connected field updates, and update data
+					'password_change_date' => array ( // db row to update
+						'type' => 'date', // type of field (int/text/date/etc)
+						'value' => 'NOW()' // value [todo: complex reference
+					)
+				)
 			),
+			// password date when first insert and password is set, needs special field with connection to password
+			'password_change_interval' => array (
+				'value' => $GLOBALS['password_change_interval'],
+				'output_name' => 'Password change interval',
+				'error_check' => 'intervalshort', // can be any date length format. n Y/M/D [not H/M/S], only one set, no combination
+				'type' => 'text',
+				'size' => 5, // make it 5 chars long
+				'length' => 5
+			),
+			// password reset force interval, if set, user needs to reset password after X time period
 			"enabled" => array (
 				"value" => $GLOBALS["enabled"], 
 				"output_name" => "Enabled", 
@@ -32,6 +48,26 @@
 					"0" => "No"
 				)
 			),
+			"strict" => array (
+				"value" => $GLOBALS["strict"],
+				"output_name" => "Strict (Lock after errors)",
+				"type" => "binary",
+				"int" => 1,
+				"element_list" => array (
+					"1" => "Yes",
+					"0" => "No"
+				)
+			),
+			"locked" => array (
+				"value" => $GLOBALS["locked"],
+				"output_name" => "Locked (auto set if strict with errors)",
+				"type" => "binary",
+				"int" => 1,
+				"element_list" => array (
+					"1" => "Yes",
+					"0" => "No"
+				)
+			),
 			"admin" => array (
 				"value" => $GLOBALS["admin"],
 				"output_name" => "Admin",
@@ -98,12 +134,31 @@
 				"type" => "drop_down_db",
 				"query" => "SELECT edit_access_right_id, name FROM edit_access_right ORDER BY level"
 			),
+			"login_error_count" => array (
+				"output_name" => "Login error count",
+				"value" => $GLOBALS['login_error_count'],
+				"type" => "view",
+				"empty" => "0"
+			),
+			"login_error_date_last" => array (
+				"output_name" => "Last login error",
+				"value" => $GLOBALS['login_error_date_liast'],
+				"type" => "view",
+				"empty" => "-"
+			),
+			"login_error_date_first" => array (
+				"output_name" => "First login error",
+				"value" => $GLOBALS['login_error_date_first'],
+				"type" => "view",
+				"empty" => "-"
+			),
+			// planned delete lock flag
 			"protected" => array (
 				"value" => $GLOBALS["protected"],
 				"int" => 1
 			)
 		),
-		"load_query" => "SELECT edit_user_id, username, enabled, debug, db_debug FROM edit_user ORDER BY username",
+		"load_query" => "SELECT edit_user_id, username, enabled, debug, db_debug, strict, locked, login_error_count FROM edit_user ORDER BY username",
 		"table_name" => "edit_user",
 		"show_fields" => array (
 			array (
@@ -124,6 +179,20 @@
 				"binary" => array("Yes", "No"),
 				"before_value" => "DB Debug: "
 			),
+			array (
+				"name" => "strict",
+				"binary" => array("Yes", "No"),
+				"before_value" => "Strict: "
+			),
+			array (
+				"name" => "locked",
+				"binary" => array("Yes", "No"),
+				"before_value" => "Locked: "
+			),
+			array (
+				"name" => "login_error_count",
+				"before_value" => "Errors: "
+			)
 		),
 		"element_list" => array (
 			"edit_access_user" => array (

www/configs/config.inc

@@ -224,6 +224,15 @@
 		}
 	}
 
+	// turn off debug if debug flag is OFF
+	if (DEBUG == false)
+	{
+		$ECHO_ALL = 0;
+		$DEBUG_ALL = 0;
+		$PRINT_ALL = 0;
+		$DB_DEBUG = 0;
+	}
+
 	// any other global definitons here
 //	DEFINE('SOME_ID', <SOME VALUE>);
 	

www/layout/admin/default/javascript/jquery.js

@@ -1 +1 @@
-jquery-1.8.2.min.js
+jquery-1.11.1.js

www/layout/admin/default/javascript/prototype.js

@@ -1 +1 @@
-prototype-1.7.1.0.js
+scriptaculous/prototype.js

www/layout/admin/default/javascript/scriptaculous/prototype.js

@@ -0,0 +1 @@
+prototype-1.7.2.0.js

www/layout/admin/default/templates/edit_elements.tpl

@@ -14,6 +14,9 @@
 		</td>
 		<td class="{$element.color}" class="normal">
 		{* here is depending on type the content data *}
+		{if $element.type == 'view'}
+			{$element.data.value}
+		{/if}
 		{if $element.type == 'binary' || $element.type == 'radio_array'}
 			{html_radios values=$element.data.value output=$element.data.output name=$element.data.name selected=$element.data.checked separator=$element.data.separator}
 		{/if}

www/libs/Class.Admin.Backend.inc

@@ -162,6 +162,8 @@
 
 			// get the session pages array
 			$pages = $_SESSION["PAGES"];
+			if (!is_array($pages))
+				$pages = array ();
 
 //$this->debug('pages', $this->print_ar($pages));
 

www/libs/Class.Basic.inc

@@ -97,6 +97,8 @@
 		public $class_info; // class info var
 
 		public $page_name;
+		public $host_name;
+		public $host_port;
 
 		private $error_id; // error ID for errors in classes
 		private $error_string; // error strings in classes (for error_id)
@@ -176,6 +178,7 @@
 
 			// set the page name
 			$this->page_name = $this->get_page_name();
+			$this->host_name = $this->get_host_name();
 
 			// set the paths matching to the valid file types
 			$this->data_path = array (
@@ -387,7 +390,7 @@
 				$this->fdebug_fp();
 				if ($enter)
 					$string .= "\n";
-				$string = "[".$this->print_time()."] [".$this->get_page_name()."] - ".$string;
+				$string = "[".$this->print_time()."] [".$this->get_page_name(2)."] - ".$string;
 				fwrite($this->debug_fp, $string);
 				$this->fdebug_fp();
 			}
@@ -451,7 +454,7 @@
 				if (!isset($this->error_msg[$level]))
 					$this->error_msg[$level] = '';
 				$error_string = '<div>';
-				$error_string .= '[<span style="font-weight: bold; color: #5e8600;">'.$this->print_time().'</span>] [<span style="font-weight: bold; color: #c56c00;">'.$level.'</span>] [<span style="color: #08b369;">'.$this->get_page_name().'</span>] [<span style="color: #0062A2;">'.$this->running_uid.'</span>] {<span style="font-style: italic; color: #928100;">'.get_class($this).'</span>} - '.$string;
+				$error_string .= '[<span style="font-weight: bold; color: #5e8600;">'.$this->print_time().'</span>] [<span style="font-weight: bold; color: #c56c00;">'.$level.'</span>] [<span style="color: #b000ab;">'.$this->host_name.'</span>] [<span style="color: #08b369;">'.$this->page_name.'</span>] [<span style="color: #0062A2;">'.$this->running_uid.'</span>] {<span style="font-style: italic; color: #928100;">'.get_class($this).'</span>} - '.$string;
 				$error_string .= "</div><!--#BR#-->";
 				if ($strip)
 				{
@@ -461,7 +464,7 @@
 					$string = preg_replace("/(<\/?)(\w+)([^>]*>)/", "", $string);
 				}
 				// same string put for print (no html crap inside)
-				$error_string_print = '['.$this->print_time().'] ['.$this->get_page_name().'] ['.$this->running_uid.'] {'.get_class($this).'} <'.$level.'> - '.$string;
+				$error_string_print = '['.$this->print_time().'] ['.$this->host_name.'] ['.$this->get_page_name(2).'] ['.$this->running_uid.'] {'.get_class($this).'} <'.$level.'> - '.$string;
 				$error_string_print .= "\n";
 				// write to file if set
 				$this->write_error_msg($level, $error_string_print);
@@ -797,8 +800,22 @@
 				return $atag.$email;
 		}
 
+		// METHOD get_host_name
+		// PARAMS none
+		// RETURN host name
+		// DESCRIPTION
+		// get the host name without the port as given by the SELF var
+		public function get_host_name()
+		{
+			list($host_name, $port) = explode(":", $_SERVER['HTTP_HOST']);
+			$this->host_port = $port;
+			return $host_name;
+		}
+
 		// METHOD get_page_name
-		// PARAMS strip page file name extension, default is no
+		// PARAMS 1: strip page file name extension
+		//        0: keep filename as is
+		//        2: keep filename as is, but add dirname too
 		// RETURN filename
 		// DESCRIPTION
 		// get the page name of the curronte page:
@@ -806,8 +823,10 @@
 		{
 			// get the file info
 			$page_temp = pathinfo($_SERVER["PHP_SELF"]);
-			if ($strip_ext)
+			if ($strip_ext == 1)
 				return $page_temp['filename'];
+			elseif ($strip_ext == 2)
+				return $_SERVER['PHP_SELF'];
 			else
 				return $page_temp['basename'];
 		}

www/libs/Class.DB.Array.IO.inc

@@ -133,9 +133,9 @@
 		public function db_dump_array($write = 0)
 		{
 			reset($this->table_array);
-			while(list($spalte, $werte_array) = each($this->table_array))
+			while(list($column, $data_array) = each($this->table_array))
 			{
-				$string .= "<b>".$spalte."</b> -> ".$werte_array["value"]."<br>";
+				$string .= "<b>".$column."</b> -> ".$data_array["value"]."<br>";
 			}
 			// add output to internal error_msg
 			if ($write)
@@ -184,12 +184,12 @@
 		public function db_reset_array($reset_pk = 0)
 		{
 			reset($this->table_array);
-			while(list($spalte, $werte_array) = each($this->table_array))
+			while(list($column, $data_array) = each($this->table_array))
 			{
-				if (!$this->table_array[$spalte]["pk"])
-					unset($this->table_array[$spalte]["value"]);
+				if (!$this->table_array[$column]["pk"])
+					unset($this->table_array[$column]["value"]);
 				else if ($reset_pk)
-					unset($this->table_array[$spalte]["value"]);
+					unset($this->table_array[$column]["value"]);
 			}
 		}
 
@@ -208,27 +208,27 @@
 			$q .= $this->pk_name." = ".$this->table_array[$this->pk_name]["value"]." ";
 			// delete files and build FK query
 			reset($this->table_array);
-			while(list($spalte, $werte_array) = each($this->table_array))
+			while(list($column, $data_array) = each($this->table_array))
 			{
 				// suchen nach bildern und löschen ...
-				if ($this->table_array[$spalte]["file"] && file_exists($this->table_array[$spalte]["url"].$this->table_array[$spalte]["value"]))
+				if ($this->table_array[$column]["file"] && file_exists($this->table_array[$column]["url"].$this->table_array[$column]["value"]))
 				{
-					if (file_exists($this->table_array[$spalte]["path"].$this->table_array[$spalte]["value"]))
-						unlink($this->table_array[$spalte]["path"].$this->table_array[$spalte]["value"]);
-					$dateiname = str_replace("_tn", "", $this->table_array[$spalte]["value"]);
-					if (file_exists($this->table_array[$spalte]["path"].$dateiname))
-						unlink($this->table_array[$spalte]["path"].$dateiname);
+					if (file_exists($this->table_array[$column]["path"].$this->table_array[$column]["value"]))
+						unlink($this->table_array[$column]["path"].$this->table_array[$column]["value"]);
+					$dateiname = str_replace("_tn", "", $this->table_array[$column]["value"]);
+					if (file_exists($this->table_array[$column]["path"].$dateiname))
+						unlink($this->table_array[$column]["path"].$dateiname);
 				}
  
-				if ($this->table_array[$spalte]["fk"])
+				if ($this->table_array[$column]["fk"])
 				{
 					// zusammenstellen der FKs
 					if ($q_where) 
 						$q_where .= " AND ";
-					$q_where .= $spalte." = ".$this->table_array[$spalte]["value"];
+					$q_where .= $column." = ".$this->table_array[$column]["value"];
 				}
 				// allgemeines zurücksetzen des arrays
-				unset($this->table_array[$spalte]["value"]);
+				unset($this->table_array[$column]["value"]);
 			}
 
 			// attach fk row if there ...
@@ -257,18 +257,18 @@
 				return $this->table_array;
 			reset($this->table_array);
 			// create select part & addition FK part 
-			while (list($spalte, $werte_array)=each($this->table_array))
+			while (list($column, $data_array)=each($this->table_array))
 			{
 				if ($q_select) 
 					$q_select .= ", "; 
-				$q_select .= $spalte;
+				$q_select .= $column;
 
 				// check FK ...
-				if ($this->table_array[$spalte]["fk"] && $this->table_array[$spalte]["value"])
+				if ($this->table_array[$column]["fk"] && $this->table_array[$column]["value"])
 				{
 					if ($q_where)
 						$q_where .= " AND ";
-					$q_where .= $spalte .= " = ".$this->table_array[$spalte]["value"];
+					$q_where .= $column .= " = ".$this->table_array[$column]["value"];
 				}
 			}
  
@@ -285,23 +285,23 @@
 				if ($res = $this->db_fetch_array())
 				{  
 					reset($this->table_array);
-					while (list($spalte, $werte_array) = each($this->table_array))
+					while (list($column, $data_array) = each($this->table_array))
 					{
 						// wenn "edit" dann gib daten wie in DB zurück, ansonten aufbereiten für ausgabe
 						// ?? sollte das nicht draußen ??? man weis ja net was da drin steht --> is noch zu überlegen
-//						echo "EDIT: $edit | Spalte: $spalte | type: ".$this->table_array[$spalte]["type"]." | Res: ".$res[$spalte]."<br>";
+//						echo "EDIT: $edit | Spalte: $column | type: ".$this->table_array[$column]["type"]." | Res: ".$res[$column]."<br>";
 						if ($edit)
 						{
-							$this->table_array[$spalte]["value"] = $res[$spalte];
+							$this->table_array[$column]["value"] = $res[$column];
 							// if password, also write to hidden
-							if ($this->table_array[$spalte]["type"] == "password")
+							if ($this->table_array[$column]["type"] == "password")
 							{
-								$this->table_array[$spalte]["HIDDEN_value"] = $res[$spalte];
+								$this->table_array[$column]["HIDDEN_value"] = $res[$column];
 							}
 						}
 						else
 						{
-							$this->table_array[$spalte]["value"] = $this->convert_data(nl2br($res[$spalte]));
+							$this->table_array[$column]["value"] = $this->convert_data(nl2br($res[$column]));
 							// had to put out the htmlentities from the line above as it breaks japanese characters
 						}
 					}
@@ -335,58 +335,58 @@
 				$insert = 0;
 
 			reset ($this->table_array);
-			while (list($spalte, $werte_array) = each($this->table_array))
+			while (list($column, $data_array) = each($this->table_array))
 			{
 
 /********************************* START FILE *************************************/
 				// file upload
-				if ($this->table_array[$spalte]["file"])
+				if ($this->table_array[$column]["file"])
 				{
 					// falls was im tmp drinnen, sprich ein upload, datei kopieren, Dateinamen in db schreiben
 					// falls datei schon am server (physischer pfad), dann einfach url in db schreiben (update)
 					// falls in "delete" "ja" dann loeschen (und gibts eh nur beim update)
-					if ($this->table_array[$spalte]["delete"])
+					if ($this->table_array[$column]["delete"])
 					{
-						unset($this->table_array[$spalte]["delete"]);
-						if (file_exists($this->table_array[$spalte]["path"].$this->table_array[$spalte]["value"]))
-							unlink($this->table_array[$spalte]["path"].$this->table_array[$spalte]["value"]);
-						$dateiname = str_replace("_tn", "", $this->table_array[$spalte]["value"]); 
-						if (file_exists($this->table_array[$spalte]["path"].$dateiname))
-							unlink($this->table_array[$spalte]["path"].$dateiname);
-						$this->table_array[$spalte]["value"] = "";
+						unset($this->table_array[$column]["delete"]);
+						if (file_exists($this->table_array[$column]["path"].$this->table_array[$column]["value"]))
+							unlink($this->table_array[$column]["path"].$this->table_array[$column]["value"]);
+						$dateiname = str_replace("_tn", "", $this->table_array[$column]["value"]); 
+						if (file_exists($this->table_array[$column]["path"].$dateiname))
+							unlink($this->table_array[$column]["path"].$dateiname);
+						$this->table_array[$column]["value"] = "";
 					}
 					else
 					{
-						if ($this->table_array[$spalte]["tmp"] != "none" && $this->table_array[$spalte]["tmp"])
+						if ($this->table_array[$column]["tmp"] != "none" && $this->table_array[$column]["tmp"])
 						{
 							// Dateiname zusammenbasteln: org-name + _pkid liste + .ext
-							list($name, $ext) = explode(".",$this->table_array[$spalte]["dn"]);
+							list($name, $ext) = explode(".",$this->table_array[$column]["dn"]);
 
 							// mozilla, patch
-							$fn_name = explode("/", $this->table_array[$spalte]["dn"]);
-							$this->table_array[$spalte]["dn"] = $fn_name[count($fn_name)-1];
-							$filename_parts = explode(".", $this->table_array[$spalte]["dn"]);
+							$fn_name = explode("/", $this->table_array[$column]["dn"]);
+							$this->table_array[$column]["dn"] = $fn_name[count($fn_name)-1];
+							$filename_parts = explode(".", $this->table_array[$column]["dn"]);
 							$ext = end($filename_parts);
 							array_splice($filename_parts, -1, 1);
 							$name = str_replace(" ", "_", implode(".", $filename_parts));
 							//echo "PK: $pk_ids_file<br>";
 							$dateiname = $name.$pk_ids_file.".".$ext;
 							//echo "Dn: $dateiname";
-							copy($this->table_array[$spalte]["tmp"], $this->table_array[$spalte]["path"].$dateiname);
+							copy($this->table_array[$column]["tmp"], $this->table_array[$column]["path"].$dateiname);
 							// automatisch thumbnail generieren, geht nur mit convert (ImageMagic!!!), aber nur bei bild ..
 							if (strtolower($ext) == "jpeg" || strtolower($ext) == "jpg" || strtolower($ext) == "gif" || strtolower($ext) == "png")
 							{ 
 								$dateiname_tn = $name.$pk_ids_file."_tn.".$ext;
-								$eingang = $this->table_array[$spalte]["path"].$dateiname;
-								$ausgang = $this->table_array[$spalte]["path"].$dateiname_tn;
+								$eingang = $this->table_array[$column]["path"].$dateiname;
+								$ausgang = $this->table_array[$column]["path"].$dateiname_tn;
 								$com = "convert -geometry 115 $eingang $ausgang";
 								exec($com);
-								$this->table_array[$spalte]["value"] = $dateiname_tn;
+								$this->table_array[$column]["value"] = $dateiname_tn;
 							}
 							else
-								$this->table_array[$spalte]["value"] = $dateiname;
+								$this->table_array[$column]["value"] = $dateiname;
 						}
-						else if (file_exists($this->table_array[$spalte]["path"].$this->table_array[$spalte]["value"]))
+						else if (file_exists($this->table_array[$column]["path"].$this->table_array[$column]["value"]))
 						{
 							// mach gar nix, wenn bild schon da ???
 						}
@@ -394,16 +394,17 @@
 				} // file IF
 /********************************* END FILE **************************************/
 
-				if (!$this->table_array[$spalte]["pk"] && strlen($spalte) > 0 )
+				// do not write 'pk' (primary key) or 'view' values
+				if (!$this->table_array[$column]["pk"] && $this->table_array[$column]['type'] != 'view' && strlen($column) > 0 )
 				{
 					// for password use hidden value if main is not set
-					if ($this->table_array[$spalte]["type"] == "password" && !$this->table_array[$spalte]["value"])
-						$this->table_array[$spalte]["value"] = $this->table_array[$spalte]["HIDDEN_value"];
+					if ($this->table_array[$column]["type"] == "password" && !$this->table_array[$column]["value"])
+						$this->table_array[$column]["value"] = $this->table_array[$column]["HIDDEN_value"];
 					if (!$insert)
 					{
 						if (strlen($q_data)) 
 							$q_data .= ", ";
-						$q_data .= $spalte." = ";
+						$q_data .= $column." = ";
 					}
 					else
 					// this is insert
@@ -412,19 +413,19 @@
 							$q_data .= ", ";
 						if ($q_vars)
 							$q_vars .= ", ";
-						$q_vars .= $spalte;
+						$q_vars .= $column;
 						
 					}
 					// integer is different
-					if ($this->table_array[$spalte]["int"] || $this->table_array[$spalte]["int_null"])
+					if ($this->table_array[$column]["int"] || $this->table_array[$column]["int_null"])
 					{
-$this->debug('write_check', "[$spalte][".$this->table_array[$spalte]["value"]."] Foo: ".isset($this->table_array[$spalte]["value"])." | ".$this->table_array[$spalte]["int_null"]);
-						if (!$this->table_array[$spalte]["value"] && $this->table_array[$spalte]["int_null"])
+$this->debug('write_check', "[$column][".$this->table_array[$column]["value"]."] Foo: ".isset($this->table_array[$column]["value"])." | ".$this->table_array[$column]["int_null"]);
+						if (!$this->table_array[$column]["value"] && $this->table_array[$column]["int_null"])
 							$_value = 'NULL';
-						elseif (!isset($this->table_array[$spalte]["value"]))
+						elseif (!isset($this->table_array[$column]["value"]))
 							$_value = 0;
 						else
-							$_value = $this->table_array[$spalte]["value"];
+							$_value = $this->table_array[$column]["value"];
 						$q_data .= $_value;
 					}
 					else
@@ -433,9 +434,9 @@ $this->debug('write_check', "[$spalte][".$this->table_array[$spalte]["value"]."]
 						$q_data .= "'";
 						// if add slashes do convert & add slashes else write AS is
 						if ($addslashes)
-							$q_data .= $this->db_escape_string($this->convert_entities($this->table_array[$spalte]["value"]));
+							$q_data .= $this->db_escape_string($this->convert_entities($this->table_array[$column]["value"]));
 						else
-							$q_data .= addslashes($this->table_array[$spalte]["value"]);
+							$q_data .= addslashes($this->table_array[$column]["value"]);
 						$q_data .= "'";
 					}
 				}
@@ -445,14 +446,14 @@ $this->debug('write_check', "[$spalte][".$this->table_array[$spalte]["value"]."]
 			// get it at the end, cause now we can be more sure of no double IDs, etc
 			reset($this->table_array);
 			// create select part & addition FK part 
-			while (list($spalte, $werte_array) = each($this->table_array))
+			while (list($column, $data_array) = each($this->table_array))
 			{
 				// check FK ...
-				if ($this->table_array[$spalte]["fk"] && $this->table_array[$spalte]["value"])
+				if ($this->table_array[$column]["fk"] && $this->table_array[$column]["value"])
 				{
 					if ($q_where)
 						$q_where .= " AND ";
-					$q_where .= $spalte .= " = ".$this->table_array[$spalte]["value"];
+					$q_where .= $column .= " = ".$this->table_array[$column]["value"];
 				}
 			}
 

www/libs/Class.DB.IO.inc

@@ -312,7 +312,7 @@
 			$this->db_pwd = $db_config['db_pass'];
 			$this->db_host = $db_config['db_host'];
 			$this->db_port = array_key_exists('db_port', $db_config) ? $db_config['db_port'] : '5432';
-			$this->db_schema = array_key_exists('db_schema', $db_config) ? $db_config['db_schema'] : 'public';
+			$this->db_schema = array_key_exists('db_schema', $db_config) ? $db_config['db_schema'] : ''; // do not set to 'public' if not set, because the default is already public
 			$this->db_encoding = array_key_exists('db_encoding', $db_config) ? $db_config['db_encoding'] : '';
 			$this->db_type = 'db_'.$db_config['db_type'];
 			$this->db_ssl = array_key_exists('db_ssl', $db_config) ? $db_config['db_ssl'] : 'allow';
@@ -600,7 +600,7 @@
 		}
 
 		// METHOD _db_prepare_exec
-		// PARAMS query, primary key
+		// PARAMS query, primary key [if set to NULL no returning will be added]
 		// RETURN md5 OR boolean false on error
 		// DESC   sub function for db_exec and db_exec_async
 		//        * checks query is set
@@ -643,29 +643,32 @@
 			// if we do have an insert, check if there is no RETURNING pk_id, add it if I can get the PK id
 			if ($this->_check_query_for_insert($this->query, true))
 			{
-				if (!$pk_name)
-				{
-					// TODO: get primary key from table name
-					list($schema, $table) = $this->_db_return_table($this->query);
-					if (!$this->pk_name_table[$table])
-					{
-						$this->pk_name_table[$table] = $this->db_functions->_db_primary_key($table, $schema);
-					}
-					$pk_name = $this->pk_name_table[$table];
-				}
 				$this->pk_name = $pk_name;
-				if (!preg_match("/ returning /i", $this->query) && $this->pk_name)
+				if ($pk_name != 'NULL')
 				{
-					$this->query .= " RETURNING ".$this->pk_name;
-					$this->returning_id = true;
-				}
-				elseif (preg_match("/ returning (.*)/i", $this->query, $matches) && $this->pk_name)
-				{
-					if (!preg_match("/$this->pk_name/", $matches[1]))
+					if (!$pk_name)
 					{
-						$this->query .= " , ".$this->pk_name;
+						// TODO: get primary key from table name
+						list($schema, $table) = $this->_db_return_table($this->query);
+						if (!$this->pk_name_table[$table])
+						{
+							$this->pk_name_table[$table] = $this->db_functions->_db_primary_key($table, $schema);
+						}
+						$pk_name = $this->pk_name_table[$table];
+					}
+					if (!preg_match("/ returning /i", $this->query) && $this->pk_name)
+					{
+						$this->query .= " RETURNING ".$this->pk_name;
 						$this->returning_id = true;
 					}
+					elseif (preg_match("/ returning (.*)/i", $this->query, $matches) && $this->pk_name)
+					{
+						if (!preg_match("/$this->pk_name/", $matches[1]))
+						{
+							$this->query .= " , ".$this->pk_name;
+							$this->returning_id = true;
+						}
+					}
 				}
 			}
 			// for DEBUG, only on first time ;)
@@ -731,7 +734,7 @@
 					// if not select do here
 					// count affected rows
 					$this->num_rows = $this->db_functions->_db_affected_rows($this->cursor);
-					if ($this->_check_query_for_insert($this->query, true))
+					if ($this->_check_query_for_insert($this->query, true) && $this->pk_name != 'NULL')
 					{
 						// set insert_id
 						if (!$this->returning_id)
@@ -755,6 +758,29 @@
 		// PUBLIC METHODS
 		// *************************************************************
 
+		// METHOD db_reset_query_called
+		// PARAMS query
+		// RETURN none
+		// DESC   resets the call times for the max query called to 0
+		//        USE CAREFULLY: rather make the query prepare -> execute
+		public function db_reset_query_called($query)
+		{
+			$this->query_called[md5($query)] = 0;
+		}
+
+		// METHOD db_get_query_called
+		// PARAMS query
+		// RETURN count of query called
+		// DESC   gets how often a query was called already
+		public function db_get_query_called($query)
+		{
+			$md5 = md5($query);
+			if ($this->query_called[$md5])
+				return $this->query_called[$md5];
+			else
+				return 0;
+		}
+
 		// METHOD db_close
 		// PARAMS none
 		// RETURN none
@@ -1047,6 +1073,7 @@
 		//                 (if this was not set, method will quit with a 0 (failure)
 		//        pk_name -> optional primary key name, for insert id return if the pk name is very different
 		//                   if pk name is table name and _id, pk_name is not needed to be set
+		//                   if NULL is given here, no RETURNING will be auto added
 		// RETURN cursor for this query
 		// DESC   executes the query and returns & sets the internal cursor
 		//        fruthermore this functions also sets varios other vars 

www/libs/Class.Form.Generate.inc

@@ -25,7 +25,8 @@
 	*        "fk" => 1/0 - sets the foreign key (do not use at the moment ... buggy ;)
 	*        "mandatory" => 1/0 - triggers * in output, but nor error check
 	*        "output_name" => "text" - text put as label for the element
-	*        "type" => "text/textarea/date/drop_down_db/drop_down_array/drop_down_db_input/drop_down_db_same_db/radio_array/binary/hidden/file/password"
+	*        "type" => "view/text/textarea/date/drop_down_db/drop_down_array/drop_down_db_input/drop_down_db_same_db/radio_array/binary/hidden/file/password"
+	*					View is special, it just prints out the data as is, will not be saved
 	*                   1) more will come
 	*                   2) keep in mind that binary will not be checked, as it is always set to a value (default is "no")
 	*        ---- the next four fields are only NECESSARY (!!!) for drop_down_db_input
@@ -44,6 +45,7 @@
 	*        "error_check" => "custom/email/date/number/unique" - 1) more will come
 	*        "error_regex" => "regex" - if error_check is custom regex here
 	*        "error_example" => "text" - example input text for error_check (only custom right now) 
+	*        "empty" => "value/text" - ONLY for view. If no data found, set this value
 	*        --- file:
 	*        "save_dir" => "directory where it should be saved to
 	*        "accept_type" => "mime types accepted (mime/text,mime/jpeg ... etc)"
@@ -223,6 +225,7 @@
 		public $error; // the error flag set for printing red error msg
 		public $warning; // warning flag, for information (saved, loaded, etc)
 		public $archive_pk_name; // the pk name for the load select form
+		private $int_pk_name; // primary key, only internal usage
 		public $reference_array = array (); // reference arrays -> stored in $this->reference_array[$table_name]=>array();
 		public $element_list; // element list for elements next to each other as a special sub group
 		public $my_page_name; // the name of the page without .php extension
@@ -267,6 +270,7 @@
 			$this->load_query = $config_array["load_query"];
 			$this->archive_pk_name = "a_".$this->pk_name;
 			$this->col_name = str_replace("_id", "", $this->pk_name);
+			$this->int_pk_name = $this->pk_name;
 			// check if reference_arrays are given and proceed them
 			if (is_array($config_array["reference_arrays"]))
 			{
@@ -587,10 +591,10 @@
 				$this->db_exec($this->load_query);
 				while ($res = $this->db_fetch_array())
 				{
-					$pk_ids[] = $res[$this->pk_name];
-					if ($res[$this->pk_name] == $this->table_array[$this->pk_name]["value"])
+					$pk_ids[] = $res[$this->int_pk_name];
+					if ($res[$this->int_pk_name] == $this->table_array[$this->int_pk_name]["value"])
 					{ 
-						$pk_selected = $res[$this->pk_name];
+						$pk_selected = $res[$this->int_pk_name];
 					}
 					unset($t_string);
 					for ($i = 0; $i < count($this->field_array); $i ++)
@@ -645,7 +649,7 @@
 				if ($this->group_level_user <= $this->security_level["save"])
 				{
 					$seclevel_okay = 1;
-					if (!$this->table_array[$this->pk_name]["value"]) 
+					if (!$this->table_array[$this->int_pk_name]["value"]) 
 					{ 
 						$save = $this->l->__("Save");
 					}
@@ -656,12 +660,12 @@
 					// print the old_school hidden if requestet
 					if ($old_school_hidden)
 					{
-						$pk_name = $this->pk_name;
-						$pk_value = $this->table_array[$this->pk_name]["value"];
+						$pk_name = $this->int_pk_name;
+						$pk_value = $this->table_array[$this->int_pk_name]["value"];
 					}
 				} // show save part
 				// show delete part only if pk is set && we want to see the delete
-				if ($this->table_array[$this->pk_name]["value"] && !$hide_delete && $this->group_level_user <= $this->security_level["delete"])
+				if ($this->table_array[$this->int_pk_name]["value"] && !$hide_delete && $this->group_level_user <= $this->security_level["delete"])
 				{
 					$show_delete = 1;
 				}
@@ -687,6 +691,11 @@
 				$output_name .= ' *';
 			// create right side depending on "definiton" in table_array
 			$type = $this->table_array[$element_name]["type"];
+			// view only output
+			if ($this->table_array[$element_name]["type"] == "view")
+			{
+				$data['value'] = !$this->table_array[$element_name]["value"] ? $this->table_array[$element_name]['empty'] : $this->table_array[$element_name]["value"];
+			}
 			// binary true/false element
 			if ($this->table_array[$element_name]["type"] == "binary")
 			{
@@ -885,6 +894,9 @@
 								break;
 							case "datetime": // YYYY-MM-DD HH:MM[:SS]
 								break;
+							case "intervalshort": // ony interval n [Y/M/D] only
+								if (preg_match("/^\d{1,3}\ ?[YMDymd]{1}$/", $this->table_array[$key]['value']))
+									$this->msg .= sprintf($this->l->__('Please enter a valid time interval in the format <length> Y|M|D for the <b>%s</b> Field!<br>'), $this->table[$key]['output_name']);
 							case "email":
 								if (!preg_match("/$this->email_regex/", $this->table_array[$key]["value"]))
 									$this->msg .= sprintf($this->l->__("Please enter a valid E-Mail Address for the <b>%s</b> Field!<br>"), $this->table_array[$key]["output_name"]);
@@ -892,8 +904,8 @@
 							// check unique, check if field in table is not yet exist
 							case "unique":
 								$q = "SELECT ".$key." FROM ".$this->table_name." WHERE ".$key." = '".addslashes($this->table_array[$key]["value"])."'";
-								if ($this->table_array[$this->pk_name]["value"])
-									$q .= " AND ".$this->pk_name." <> ".$this->table_array[$this->pk_name]["value"];
+								if ($this->table_array[$this->int_pk_name]["value"])
+									$q .= " AND ".$this->int_pk_name." <> ".$this->table_array[$this->int_pk_name]["value"];
 								list($$key) = $this->db_return_row($q);
 								if ($$key)
 									$this->msg .= sprintf($this->l->__("The field <b>%s</b> can be used only once!<br>"), $this->table_array[$key]["output_name"]);
@@ -905,7 +917,13 @@
 							case "alphanumeric":
 //$this->debug('edit', 'IN Alphanumeric');
 								if (!preg_match("/^[0-9A-Za-z_-]+$/", $this->table_array[$key]["value"]))
-									$this->msg .= sprintf($this->l->__("Please enter a valid alphanumeric (Numbers and Letters only, no spaces) value for the <b>%s</b> Field!<br>"), $this->table_array[$key]["output_name"]);
+									$this->msg .= sprintf($this->l->__("Please enter a valid alphanumeric (Numbers and Letters only also - and _, no spaces) value for the <b>%s</b> Field!<br>"), $this->table_array[$key]["output_name"]);
+								break;
+							// this one also allows @ and .
+							case "alphanumericextended":
+//$this->debug('edit', 'IN Alphanumeric');
+								if (!preg_match("/^[0-9A-Za-z_-@\.]+$/", $this->table_array[$key]["value"]))
+									$this->msg .= sprintf($this->l->__("Please enter a valid alphanumeric extended (Numbers, Letters, -,  _, @ and . only, no spaces) value for the <b>%s</b> Field!<br>"), $this->table_array[$key]["output_name"]);
 								break;
 							case "password":
 								// password can only be alphanumeric + special chars
@@ -1071,9 +1089,9 @@
 					if (!$this->table_array[$order_name]["value"])
 						$this->table_array[$order_name]["value"] = 1;
 				}
-				else if ($this->table_array[$this->pk_name]["value"])
+				else if ($this->table_array[$this->int_pk_name]["value"])
 				{
-					$q = "SELECT $order_name FROM ".$this->table_name." WHERE ".$this->pk_name." = ".$this->table_array[$this->pk_name]["value"];
+					$q = "SELECT $order_name FROM ".$this->table_name." WHERE ".$this->int_pk_name." = ".$this->table_array[$this->int_pk_name]["value"];
 					list($this->table_array[$order_name]["value"]) = $this->db_return_row($q);
 				}
 			}
@@ -1130,7 +1148,7 @@
 				while (list($key, $value) = each($this->reference_array))
 				{
 					unset($this->reference_array[$key]["selected"]);
-					$q = "SELECT ".$this->reference_array[$key]["other_table_pk"]." FROM ".$this->reference_array[$key]["table_name"]." WHERE ".$this->pk_name."=".$this->table_array[$this->pk_name]["value"];
+					$q = "SELECT ".$this->reference_array[$key]["other_table_pk"]." FROM ".$this->reference_array[$key]["table_name"]." WHERE ".$this->int_pk_name."=".$this->table_array[$this->int_pk_name]["value"];
 					while ($res = $this->db_return($q))
 						$this->reference_array[$key]["selected"][] = $res[$this->reference_array[$key]["other_table_pk"]];
 				}
@@ -1276,12 +1294,12 @@
 				reset($this->reference_array);
 				foreach ($this->reference_array AS $reference_array)
 				{
-					$q = "DELETE FROM ".$reference_array["table_name"]." WHERE ".$this->pk_name."=".$this->table_array[$this->pk_name]["value"];
+					$q = "DELETE FROM ".$reference_array["table_name"]." WHERE ".$this->int_pk_name."=".$this->table_array[$this->int_pk_name]["value"];
 					$this->db_exec($q);
-					$q = "INSERT INTO ".$reference_array["table_name"]." (".$reference_array["other_table_pk"].", ".$this->pk_name.") VALUES ";
+					$q = "INSERT INTO ".$reference_array["table_name"]." (".$reference_array["other_table_pk"].", ".$this->int_pk_name.") VALUES ";
 					for ($i = 0; $i < count($reference_array["selected"]); $i ++)
 					{
-						$t_q = "(".$reference_array["selected"][$i].", ".$this->table_array[$this->pk_name]["value"].")";
+						$t_q = "(".$reference_array["selected"][$i].", ".$this->table_array[$this->int_pk_name]["value"].")";
 						$this->db_exec($q.$t_q);
 					}
 				} // foreach reference arrays
@@ -1339,7 +1357,7 @@
 							}
 							// write all data (insert/update) because I don't know until all are processed if it is insert or update
 							// don't write primary key backup for update
-//$this->debug('edit_error', "I: $i | EL Name: $prfx$el_name | Data: ".$_POST[$prfx.$el_name][$i]." {".$_POST[$prfx.$el_name]."} | Type: ".$type[$i]." | PK: ".$data_array["pk_id"]." ");
+$this->debug('edit_error', "I: $i | EL Name: $prfx$el_name | Data: ".$_POST[$prfx.$el_name][$i]." {".$_POST[$prfx.$el_name]."} | Type: ".$type[$i]." | PK: ".$data_array["pk_id"]." ");
 							if (!$data_array["pk_id"])
 							{
 								// update
@@ -1390,7 +1408,7 @@
 							}
 							else
 							{
-								$q = $q_begin[$i].$q_names[$i].", ".$this->pk_name.$q_middle[$i].$q_values[$i].", ".$this->table_array[$this->pk_name]["value"].$q_end[$i];
+								$q = $q_begin[$i].$q_names[$i].", ".$this->int_pk_name.$q_middle[$i].$q_values[$i].", ".$this->table_array[$this->int_pk_name]["value"].$q_end[$i];
 							}
 //$this->debug('edit', "Q: ".$q."<br>");
 							// write the dataset
@@ -1415,7 +1433,7 @@
 				reset($this->reference_array);
 				foreach ($this->reference_array AS $reference_array)
 				{
-					$q = "DELETE FROM ".$reference_array["table_name"]." WHERE ".$this->pk_name." = ".$this->table_array[$this->pk_name]["value"];
+					$q = "DELETE FROM ".$reference_array["table_name"]." WHERE ".$this->int_pk_name." = ".$this->table_array[$this->int_pk_name]["value"];
 					$this->db_exec($q);
 				}
 			}
@@ -1425,7 +1443,7 @@
 				reset($this->element_list);
 				while (list($table_name, $data_array) = each($this->element_list))
 				{
-					$q = "DELETE FROM ".$table_name." WHERE ".$this->pk_name." = ".$this->table_array[$this->pk_name]["value"];
+					$q = "DELETE FROM ".$table_name." WHERE ".$this->int_pk_name." = ".$this->table_array[$this->int_pk_name]["value"];
 					$this->db_exec($q);
 				}
 			}
@@ -1555,18 +1573,18 @@
 				$data['type'][$data["prefix"].$this->element_list[$table_name]["read_data"]["name"]] = 'string';	
 				// build the read query
 				$q = "SELECT ";
-//				if (!$this->table_array[$this->pk_name]["value"])
+//				if (!$this->table_array[$this->int_pk_name]["value"])
 //					$q .= "DISTINCT ";
 				// prefix join key with table name
 				$q .= str_replace($this->element_list[$table_name]["read_data"]["pk_id"], $this->element_list[$table_name]["read_data"]["table_name"].".".$this->element_list[$table_name]["read_data"]["pk_id"], implode(", ", $q_select))." ";
-//				if (!$this->table_array[$this->pk_name]["value"] && $this->element_list[$table_name]["read_data"]["order"])
+//				if (!$this->table_array[$this->int_pk_name]["value"] && $this->element_list[$table_name]["read_data"]["order"])
 //					$q .= ", ".$this->element_list[$table_name]["read_data"]["order"]." ";
 				$q .= "FROM ".$this->element_list[$table_name]["read_data"]["table_name"]." ";
 				$q .= "LEFT JOIN ".$table_name." ";
 				$q .= "ON (";
 				$q .= $this->element_list[$table_name]["read_data"]["table_name"].".".$this->element_list[$table_name]["read_data"]["pk_id"]." = ".$table_name.".".$this->element_list[$table_name]["read_data"]["pk_id"]." ";
-//				if ($this->table_array[$this->pk_name]["value"])
-				$q .= "AND ".$this->pk_name." = ".(($this->table_array[$this->pk_name]["value"]) ? $this->table_array[$this->pk_name]["value"] : 'NULL')." ";
+//				if ($this->table_array[$this->int_pk_name]["value"])
+				$q .= "AND ".$this->int_pk_name." = ".(($this->table_array[$this->int_pk_name]["value"]) ? $this->table_array[$this->int_pk_name]["value"] : 'NULL')." ";
 				$q .= ") ";
 				if ($this->element_list[$table_name]["read_data"]["order"])
 					$q .= " ORDER BY ".$this->element_list[$table_name]["read_data"]["order"];
@@ -1574,8 +1592,8 @@
 			else
 			{
 				// only create query if we have a primary key
-				if ($this->table_array[$this->pk_name]["value"])
-					$q = "SELECT ".implode(", ", $q_select)." FROM ".$table_name." WHERE ".$this->pk_name." = ".$this->table_array[$this->pk_name]["value"];
+				if ($this->table_array[$this->int_pk_name]["value"])
+					$q = "SELECT ".implode(", ", $q_select)." FROM ".$table_name." WHERE ".$this->int_pk_name." = ".$this->table_array[$this->int_pk_name]["value"];
 			}
 			// only run if we have query strnig
 			if ($q)

www/libs/Class.Login.inc

@@ -68,7 +68,6 @@
 		public $login; // pressed login
 		private $username; // login name
 		private $password; // login password
-		private $current_page_name; // the page from which this login is called
 		private $logout; // logout button
 		private $login_error; // login error code, can be matched to the array login_error_msg, which holds the string
 		private $password_change = false; // if this is set to true, the user can change passwords
@@ -154,14 +153,15 @@
 			$this->pw_new_password_confirm = $_POST['pw_new_password_confirm'];
 			// logout target (from config)
 			$this->logout_target = LOGOUT_TARGET;
-			// get the page name
-			// page_name aus PHP_SELF strippen
-			$this->current_page_name = $this->get_page_name();
 			// disallow user list for password change
 			$this->pw_change_deny_users = array ('admin');
 			// set flag if password change is okay
 			if (defined('PASSWORD_CHANGE'))
 				$this->password_change = PASSWORD_CHANGE;
+			// max login counts before error reporting
+			$this->max_login_error_count = 10;
+			// users that never get locked, even if they are set strict
+			$this->lock_deny_users = array ('admin');
 
 			// internal
 			$this->class_info["login"] = array(
@@ -243,7 +243,7 @@
 				else
 				{
 					// we have to get the themes in here too
-					$q = "SELECT eu.edit_user_id, username, password, eu.edit_group_id, eg.name AS edit_group_name, admin, ";
+					$q = "SELECT eu.edit_user_id, username, password, eu.edit_group_id, eg.name AS edit_group_name, admin, eu.login_error_count, eu.login_error_date_last, eu.login_error_date_first, eu.strict, eu.locked, ";
 					$q .= "debug, db_debug, ";
 					$q .= "eareu.level AS user_level, eareu.type AS user_type, ";
 					$q .= "eareg.level AS group_level, eareg.type AS group_type, ";
@@ -267,13 +267,33 @@
 					}
 					else
 					{
+						// if login errors is half of max errors and the last login error was less than 10s ago, forbid any new login try
+
 						// check with what kind of prefix the password begins:
 						// $2a$ or $2y$: BLOWFISCH
 						// $1$: MD5
 						// $ and one alphanumeric letter, 13 chars long, but nor $ at the end: STD_DESC
 						// if no $ => normal password
 						// NOW, if we have a password encoded, but not the correct encoder available, throw special error
-						if ((preg_match("/^\\$2(a|y)\\$/", $res['password']) && CRYPT_BLOWFISH != 1) || (preg_match("/^\\$1\\$/", $res['password']) && CRYPT_MD5 != 1) || (preg_match("/^\\$[0-9A-Za-z.]{12}$/", $res['password']) && CRYPT_STD_DES != 1))
+
+						// check flow
+						// - user is enabled
+						// - user is not locked
+						// - password is readable
+						// - encrypted password matches
+						// - plain password matches
+
+						// user is enabled
+						if (!$res["enabled"])
+						{
+							$this->login_error = 104;
+						}
+						// user is locked, either set or auto set
+						elseif ($res['locked'])
+						{
+							$this->login_error = 105;
+						}
+						elseif ((preg_match("/^\\$2(a|y)\\$/", $res['password']) && CRYPT_BLOWFISH != 1) || (preg_match("/^\\$1\\$/", $res['password']) && CRYPT_MD5 != 1) || (preg_match("/^\\$[0-9A-Za-z.]{12}$/", $res['password']) && CRYPT_STD_DES != 1))
 						{
 							$this->login_error = 9999; // this means password cannot be decrypted because of missing crypt methods
 						}
@@ -287,11 +307,6 @@
 						{
 							$this->login_error = 1012;
 						}
-						// user is enabled
-						elseif (!$res["enabled"])
-						{
-							$this->login_error = 104;
-						}
 						// nromal user processing
 						else
 						{
@@ -316,6 +331,12 @@
 								$_SESSION["LANG"] = $res["lang_short"];
 								$_SESSION["DEFAULT_CHARSET"] = $res["lang_iso"];
 								$_SESSION["DEFAULT_LANG"] = $res["lang_short"].'_'.strtolower(str_replace('-', '', $res["lang_iso"]));
+								// reset any login error count for this user
+								if ($res['login_error_count'] > 0)
+								{
+									$q = "UPDATE edit_user SET login_error_count = 0, login_error_date_last = NULL, login_error_date_first = NULL WHERE edit_user_id = ".$res['edit_user_id'];
+									$this->db_exec($q);
+								}
 								$pages = array();
 								$edit_page_ids = array();
 								// set pages access
@@ -407,9 +428,27 @@
 								$_SESSION["UNIT"] = $unit_access;
 								$_SESSION["UNIT_ACL_LEVEL"] = $unit_acl;
 								$_SESSION['EAID'] = $eauid;
-								// load edit access list for this user
 							} // user has permission to THIS page
-						} // user was not enabled
+						} // user was not enabled or other login error
+						if ($this->login_error)
+						{
+							if ($res['login_error_count'] == 0)
+								$login_error_date_first = ', login_error_date_first = NOW()';
+							// update login error count for this user
+							$q = "UPDATE edit_user SET login_error_count = login_error_count + 1, login_error_date_last = NOW() $login_error_date_first WHERE edit_user_id = ".$res['edit_user_id'];
+							$this->db_exec($q);
+							// totally lock the user if error max is reached
+							if ($res['login_error_count'] + 1 > $this->max_login_error_count)
+							{
+								// do some alert reporting in case this error is too big
+								// if strict is set, lock this user
+								// this needs manual unlocking by an admin user
+								if ($res['strict'] && !in_array($this->username, $this->lock_deny_users))
+								{
+									$q = "UPDATE edit_user SET locked = 1 WHERE edit_user_id = ".$res['edit_user_id'];
+								}
+							}
+						}
 					} // user was not found
 				} // if not username AND password where given
 				// if there was an login error, show login screen
@@ -425,19 +464,19 @@
 		// PARAMS: none
 		// RETUNR none
 		// DESC  : for every page the user access this script checks if he is allowed to do so
-		private function login_check_permissions()
+		public function login_check_permissions()
 		{
 			if ($this->euid && $this->login_error != 103)
 			{
 				$q = "SELECT filename ";
 				$q .= "FROM edit_page ep, edit_page_access epa, edit_group eg, edit_user eu ";
 				$q .= "WHERE ep.edit_page_id = epa.edit_page_id AND eg.edit_group_id = epa.edit_group_id AND eg.edit_group_id = eu.edit_group_id ";
-				$q .= "AND eu.edit_user_id = ".$this->euid." AND filename = '".$this->current_page_name."' AND eg.enabled = 1 AND epa.enabled = 1";
+				$q .= "AND eu.edit_user_id = ".$this->euid." AND filename = '".$this->page_name."' AND eg.enabled = 1 AND epa.enabled = 1";
 				$res = $this->db_return_row($q);
 				// unset mem limit if debug is set to 1
 //				if (($GLOBALS["DEBUG_ALL"] || $GLOBALS["DB_DEBUG"] || $_SESSION["DEBUG_ALL"] || $_SESSION["DB_DEBUG"]) && ini_get('memory_limit') != -1)
 //					ini_set('memory_limit', -1);
-				if ($res["filename"] == $this->current_page_name)
+				if ($res["filename"] == $this->page_name)
 				{
 					$this->permission_okay = 1;
 				}
@@ -447,13 +486,15 @@
 					$this->permission_okay = 0;
 				}
 			}
+			// if called from public, so we can check if the permissions are ok
+			return $this->permission_okay;
 		}
 
 		// METHOD: login_logout_user
 		// PARAMS: none
 		// RETURN: none
 		// DESC  : if a user pressed on logout, destroyes session and unsets all global vars
-		private function login_logout_user()
+		public function login_logout_user()
 		{
 			if ($this->logout || $this->login_error)
 			{
@@ -495,7 +536,7 @@
 		//         * if an account ACL is set, set this parallel, account ACL overrides user ACL if it applies
 		//         * if edit access ACL level is set, use this, else use page
 		//         set all base ACL levels as a list keyword -> ACL number
-		private function login_set_acl()
+		public function login_set_acl()
 		{
 			// set the mastser user id
 			$this->acl['info']['euid'] = $_SESSION['EUID'];
@@ -787,6 +828,7 @@
 				"102" => $this->l->__("Fatal Error: <b>Login Failed - Please enter username and password</b>"),
 				"103" => $this->l->__("Fatal Error: <b>You do not have the rights to access this Page</b>"),
 				"104" => $this->l->__("Fatal Error: <b>Login Failed - User not enabled</b>"),
+				"105" => $this->l->__("Fatal Error: <b>Login Failed - User is locked</b>"),
 				"220" => $this->l->__("Fatal Error: <b>Password change - The user could not be found</b>"), // actually this is an illegal user, but I mask it
 				'200' => $this->l->__("Fatal Error: <b>Password change - Please enter username and old password</b>"),
 				"201" => $this->l->__("Fatal Error: <b>Password change - The user could not be found</b>"),
@@ -943,7 +985,7 @@ EOM;
 			$q .= "(username, password, euid, event_date, event, error, data, data_binary, page, ";
 			$q .= "ip, user_agent, referer, script_name, query_string, server_name, http_host, http_accept, http_accept_charset, http_accept_encoding, session_id, ";
 			$q .= "action, action_id, action_yes, action_flag, action_menu, action_loaded, action_value, action_error) ";
-			$q .= "VALUES ('".$this->db_escape_string($username)."', '".$this->db_escape_string($password)."', ".(($this->euid) ? $this->euid : 'NULL').", NOW(), '".$this->db_escape_string($event)."', '".$this->db_escape_string($error)."', '".$this->db_escape_string($data)."', '".$data_binary."', '".$this->current_page_name."', ";
+			$q .= "VALUES ('".$this->db_escape_string($username)."', '".$this->db_escape_string($password)."', ".(($this->euid) ? $this->euid : 'NULL').", NOW(), '".$this->db_escape_string($event)."', '".$this->db_escape_string($error)."', '".$this->db_escape_string($data)."', '".$data_binary."', '".$this->page_name."', ";
 			foreach (array('REMOTE_ADDR', 'HTTP_USER_AGENT', 'HTTP_REFERER', 'SCRIPT_FILENAME', 'QUERY_STRING', 'SERVER_NAME', 'HTTP_HOST', 'HTTP_ACCEPT', 'HTTP_ACCEPT_CHARSET', 'HTTP_ACCEPT_ENCODING') as $server_code)
 			{
 				if (array_key_exists($server_code, $_SERVER))

www/libs/db_pgsql.inc

@@ -3,7 +3,7 @@
 	* AUTHOR: Clemens "Gullevek" Schwaighofer (www.gullevek.org)
 	* CREATED: 2003/04/09 
 	* SHORT DESCRIPTION:
-	* pgsq; wrapper calls
+	* pgsql wrapper calls
 	* HISTORY:
 	* 2008/04/16 (cs) wrapper for pg escape string
 	* 2007/01/11 (cs) add prepare/execute for postgres
@@ -96,16 +96,14 @@
 		}
 
 		// METHOD: _db_close
-		// PARAMS: optional database handler
+		// PARAMS: none
 		// RETURN: none
 		// DESC  : wrapper for pg_close
-		public function _db_close($dbh = '')
+		public function _db_close()
 		{
-			if (!$dbh)
-				$dbh = $this->dbh;
-			if (is_resource($dbh))
-				if (@pg_connection_status($dbh) === PGSQL_CONNECTION_OK)
-					@pg_close($dbh);
+			if (is_resource($this->dbh))
+				if (@pg_connection_status($this->dbh) === PGSQL_CONNECTION_OK)
+					@pg_close($this->dbh);
 		}
 
 		// METHOD: _db_prepare

www/libs/db_pgsql_pdo.inc

@@ -0,0 +1,358 @@
+<?
+	/*********************************************************************
+	* AUTHOR: Clemens "Gullevek" Schwaighofer (www.gullevek.org)
+	* CREATED: 2014/12/3
+	* SHORT DESCRIPTION:
+	* pgsql pdo wrapper calls
+	* HISTORY:
+	* /
+
+  /* collection of PostgreSQL wrappers
+	* REQUIRES 5.x PHP with compiled pdo pgsql (--with-pdo-pgsql)
+	*
+	*/
+
+	class db_pgsql
+	{
+		private $last_error_query;
+		private $dbh;
+		private $cursor;
+
+		// METHOD: __construct
+		// PARAMS: none
+		// RETURN: none
+		// DESC  : class constructor
+		public function __construct()
+		{
+		}
+
+		public function _db_last_error_query()
+		{
+			if ($this->last_error_query)
+				return true;
+			else
+				return false;
+		}
+		
+		// METHOD: _db_query
+		// PARAMS: query
+		// RETURN: query result
+		// DESC  : wrapper for gp_query, catches error and stores it in class var
+		public function _db_query($query)
+		{
+			$this->last_error_query = '';
+/*			// read out the query status and save the query if needed
+			$result = @pg_query($this->dbh, $query);
+			if (!$result)
+				$this->last_error_query = $query; */
+			return $result;
+		}
+
+		// METHOD: _db_send_query
+		// PARAMS: query
+		// RETURN: true/false if query was sent successful
+		// DESC  : sends an async query to the server
+		public function _db_send_query($query)
+		{
+//			return @pg_send_query($this->dbh, $query);
+		}
+
+		// METHOD: _db_get_result
+		// PARAMS: none
+		// RETURN: resource handler
+		// DESC  : wrapper for pg_get_result
+		public function _db_get_result()
+		{
+			$this->last_error_query = '';
+/*			$result = pg_get_result($this->dbh);
+			if ($error = pg_result_error($result))
+				$this->last_error_query = $error; */
+			return $result;
+		}
+
+		// METHOD: _db_close
+		// PARAMS: none
+		// RETURN: none
+		// DESC  : wrapper for pg_close
+		public function _db_close()
+		{
+			$this->cursor->closeCursor;
+			$this->cursor = null;
+			$this->dbh = null;
+		}
+		
+		// METHOD: _db_prepare
+		// PARAMS: prepare name, query
+		// RETURN: prepared statement handler
+		// DESC  : wrapper for pg_prepare
+		public function _db_prepare($name, $query)
+		{
+//			return @pg_prepare($this->dbh, $name, $query);
+		}
+
+		// METHOD: _db_execute
+		// PARAMS: prepare name, data for query
+		// RETURN: returns status
+		// DESC  : wrapper for pg_execute for running a prepared statement
+		public function _db_execute($name, $data)
+		{
+//			return @pg_execute($this->dbh, $name, $data);
+		}
+
+		// METHOD: _db_num_rows
+		// PARAMS: cursor
+		// RETURN: rows
+		// DESC  : wrapper for pg_num_rows
+		public function _db_num_rows($cursor)
+		{
+//			return pg_num_rows($cursor);
+		}
+
+		// METHOD: _db_num_fields
+		// PARAMS: cursor
+		// RETURN: number for fields in query
+		// DESC  : wrapper for pg_num_fields
+		public function _db_num_fields($cursor)
+		{
+//			return pg_num_fields($cursor);
+		}
+ 
+		// METHOD: _db_field_name
+		// PARAMS: cursor, field position
+		// RETURN: name of field
+		// DESC  : wrapper for pg_field_name
+		public function _db_field_name($cursor, $i)
+		{
+//			return pg_field_name($cursor, $i);
+		}
+
+		// METHOD: _db_fetch_array
+		// PARAMS: cursor
+		// RETURN: row
+		// DESC  : wrapper for pg_fetch_array
+		public function _db_fetch_array($cursor)
+		{
+//			return pg_fetch_array($cursor);
+		}
+
+		// METHOD: _db_affected_ros
+		// PARAMS: cursor
+		// RETURN: number for rows
+		// DESC  : wrapper for pg_affected_rows
+		public function _db_affected_rows($cursor)
+		{
+//			return pg_affected_rows($cursor); 
+		}
+
+		// METHOD: _db_insert_id
+		// PARAMS: query, primary key name
+		// RETURN: last insert primary key
+		// DESC  : reads the last inserted primary key for the query
+		//         if ther is no pk_name tries to auto built it from the table name
+		//         this only works if db schema is after "no plural names. and pk name is table name + _id
+		//         detects schema prefix in table name
+		public function _db_insert_id($query, $pk_name)
+		{
+			// only if an insert has been done
+			if (preg_match("/^insert /i", $query))
+			{
+				$schema = '';
+				// get table name from insert
+				$array = explode(' ', $query);
+				$_table = $array[2];
+				// if there is a dot inside, we need to split
+				if (strstr($_table, '.'))
+					list($schema, $table) = explode('.', $_table);
+				else
+					$table = $_table;
+				// no PK name given at all
+				if (!$pk_name)
+				{
+					// if name is plurar, make it singular
+//					if (preg_match("/.*s$/i", $table))
+//						$table = substr($table, 0, -1);
+					// set pk_name to "id"
+					$pk_name = $table."_id";
+				}
+				$seq = (($schema) ? $schema.'.' : '').$table."_".$pk_name."_seq";
+				$q = "SELECT CURRVAL('$seq') AS insert_id";
+//				$this->currval_query = $q;
+				// I have to do manually or I overwrite the original insert internal vars ...
+				if ($q = $this->_db_query($q))
+				{
+					list($id) = pg_fetch_array($q);
+				}
+				else
+				{
+					$id = array(-1, $q);
+				}
+				return $id;
+			}
+		}
+
+		// METHOD: _db_primary_key
+		// PARAMS: table and optional schema
+		// RETURN: primary key name OR false if not possible
+		// DESC  : queries database for the primary key name to this table in the selected schema
+		public function _db_primary_key($table, $schema = '')
+		{
+			if ($table)
+			{
+				// check if schema set is different from schema given, only needed if schema is not empty
+				$table_prefix = '';
+				if ($schema)
+				{
+					$q = "SHOW search_path";
+					$cursor = $this->_db_query($q);
+					$search_path = $this->_db_fetch_array($cursor)['search_path'];
+					if ($search_path != $schema)
+					{
+						$table_prefix = $schema.'.';
+					}
+				}
+				// read from table the PK name
+				// faster primary key get
+				$q = "SELECT pg_attribute.attname AS column_name, format_type(pg_attribute.atttypid, pg_attribute.atttypmod) AS type ";
+				$q .= "FROM pg_index, pg_class, pg_attribute ";
+				if ($schema)
+					$q .= ", pg_namespace ";
+				$q .= "WHERE ";
+				// regclass translates the OID to the name
+				$q .= "pg_class.oid = '".$table_prefix.$table."'::regclass AND ";
+					$q .= "indrelid = pg_class.oid AND ";
+				if ($schema)
+				{
+					$q .= "nspname = '".$schema."' AND ";
+					$q .= "pg_class.relnamespace = pg_namespace.oid AND ";
+				}
+				$q .= "pg_attribute.attrelid = pg_class.oid AND ";
+				$q .= "pg_attribute.attnum = any(pg_index.indkey) ";
+				$q .= "AND indisprimary";
+				$cursor = $this->_db_query($q);
+				if ($cursor)
+					return $this->_db_fetch_array($cursor)['column_name'];
+				else
+					return false;
+			}
+			else
+			{
+				return false;
+			}
+		}
+
+		// METHOD: _db_connect
+		// PARAMS: host name, user name, password, database name, optional port (defaults to default postgres port), optional ssl (default allow)
+		// RETURN: database handler
+		// DESC  : wrapper for pg_connect, writes out failure to screen if error occurs (hidden var)
+		public function _db_connect($db_host, $db_user, $db_pass, $db_name, $db_port = 5432, $db_ssl = 'allow')
+		{
+			// to avoid empty db_port
+			if (!$db_port)
+			{
+				$db_port = 5432;
+			}
+/*			$this->dbh = @pg_connect("host=".$db_host." port=".$db_port." user=".$db_user." password=".$db_pass." dbname=".$db_name." sslmode=".$db_ssl);
+			if (!$this->dbh)
+			{
+				die("<!-- Can't connect [host=".$db_host." port=".$db_port." user=".$db_user." password=XXXX dbname=".$db_name." sslmode=".$db_ssl."] //-->");
+			} */
+			return $this->dbh;
+		}
+
+		// METHOD: _db_print_error
+		// PARAMS: database handler, cursor
+		// RETURN: error string (HTML)
+		// DESC  : reads the last error for this cursor
+		public function _db_print_error($cursor = '')
+		{
+/*			// run the query again for the error result here
+			if (!$cursor && $this->last_error_query)
+			{
+				pg_send_query($this->dbh, $this->last_error_query);
+				$this->last_error_query = '';
+				$cursor = pg_get_result($this->dbh);
+			}
+			if (pg_result_error($cursor))
+				return "<span style=\"color: red;\"><b>-PostgreSQL-Error-></b> ".pg_result_error($cursor)."</span><br>"; */
+		}
+
+		// METHOD: _db_meta_data
+		// PARAMS: table name
+		// RETURN: array with table data
+		// DESC  : wrapper for pg_emta_data
+		public function _db_meta_data($table)
+		{
+//			return @pg_meta_data($this->dbh, $table);
+		}
+
+		// METHOD: _db_escape_string
+		// PARAMS: string
+		// RETURN: escaped string for postgres
+		// DESC  : wrapper for pg_escape_string
+		public function _db_escape_string($string)
+		{
+//			return pg_escape_string($this->dbh, $string);
+		}
+
+		// METHOD: _db_escape_bytea
+		// PARAMS: string
+		// RETURN: escape bytes for postgres
+		// DESC  : wrapper for pg_escape_bytea
+		public function _db_escape_bytea($bytea)
+		{
+//			return pg_escape_bytea($this->dbh, $bytea);
+		}
+
+		// METHOD: _db_connection_busy
+		// PARAMS: none
+		// RETURN: true/false for busy connection
+		// DESC  : wrapper for pg_connection_busy
+		public function _db_connection_busy()
+		{
+//			return pg_connection_busy($this->dbh);
+		}
+	
+		// METHOD: _db_version
+		// PARAMS: none
+		// RETURN: databse version
+		// DESC  : wrapper for pg_version
+		public function _db_version()
+		{
+			// array has client, protocol, server
+			// we just need the server
+			$v = pg_version($this->dbh);
+			return $v['server'];
+		}
+
+		// METHOD: _db_array_parse
+		// PARAMS: input text, output array [needed]
+		//         [internal] limit: are we at the end of the parse
+		//         [internal] offset: shift for {}
+		// RETURN: array with the elements
+		// DESC  : postgresql array to php array
+		public function _db_array_parse($text, &$output, $limit = false, $offset = 1)
+		{
+			if (false === $limit)
+			{
+				$limit = strlen($text) - 1;
+				$output = array();
+			}
+			if ('{}' != $text)
+				do
+				{
+					if ('{' != $text{$offset})
+					{
+						preg_match("/(\\{?\"([^\"\\\\]|\\\\.)*\"|[^,{}]+)+([,}]+)/", $text, $match, 0, $offset);
+						$offset += strlen($match[0]);
+						$output[] = ('"' != $match[1]{0} ? $match[1] : stripcslashes(substr($match[1], 1, -1)));
+						if ('},' == $match[3])
+							return $offset;
+					}
+					else
+						$offset = pg_array_parse($text, $output[], $limit, $offset + 1);
+				}
+				while ($limit > $offset);
+			return $output;
+		}
+	}
+?>