Fix debug log path

Use the SELF var itself without running it through any pathinfo filter

4dev/update/20140822_edit_update/edit_tables.sql

@@ -0,0 +1,11 @@
+-- update edit tables
+-- add login error count and last login error
+
+-- count login errors
+ALTER TABLE edit_user ADD login_error_count INT DEFAULT 0;
+-- last login error date
+ALTER TABLE edit_user ADD login_error_date_last TIMESTAMP WITHOUT TIME ZONE;
+ALTER TABLE edit_user ADD login_error_date_first TIMESTAMP WITHOUT TIME ZONE;
+-- if this is set to true, this user gets locked after max login errors are reached
+ALTER TABLE edit_user ADD strict SMALLINT DEFAULT 0;
+ALTER TABLE edit_user ADD locked SMALLINT DEFAULT 0;

www/admin/edit_base.inc

@@ -222,12 +222,17 @@
 		switch ($form->my_page_name)
 		{
 			case "edit_users":
+				$elements[] = $form->form_create_element("login_error_count");
+				$elements[] = $form->form_create_element("login_error_date_last");
+				$elements[] = $form->form_create_element("login_error_date_first");
 				$elements[] = $form->form_create_element("enabled");
 				$elements[] = $form->form_create_element("username");
 				$elements[] = $form->form_create_element("password");
 				$elements[] = $form->form_create_element("email");
 				$elements[] = $form->form_create_element("edit_group_id");
 				$elements[] = $form->form_create_element("edit_access_right_id");
+				$elements[] = $form->form_create_element("strict");
+				$elements[] = $form->form_create_element("locked");
 				$elements[] = $form->form_create_element("admin");
 				$elements[] = $form->form_create_element("debug");
 				$elements[] = $form->form_create_element("db_debug");
@@ -253,7 +258,7 @@
 					for ($i = 0; $i < count($output); $i ++)
 					{
 						$t_q = "('".$form->db_escape_string($output[$i])."')";
-						$form->db_exec($q.$t_q);
+						$form->db_exec($q.$t_q, 'NULL');
 					}
 					$elements[] = $form->form_create_element("filename");
 				}
@@ -315,7 +320,6 @@
 
 	// debug data, if DEBUG flag is on, this data is print out
 	$DEBUG_DATA['DEBUG'] = $DEBUG_TMPL;
-	$DEBUG_DATA['Id'] = '$Id: edit_base.inc 4897 2014-02-06 08:16:56Z gullevek $';
 
 	// create main data array
 	$CONTENT_DATA = array_merge($HEADER, $DATA, $DEBUG_DATA);

www/admin/edit_order.php

@@ -29,7 +29,6 @@
 	// set session name
 	define('SET_SESSION_NAME', EDIT_SESSION_NAME);
 	require(LIBS."Class.Login.inc");
-	require(LIBS."Class.DB.IO.inc");
 	require(LIBS.'Class.Smarty.Extend.inc');
 
 	// default lang
@@ -195,7 +194,6 @@
 
 	// debug data, if DEBUG flag is on, this data is print out
 	$DEBUG_DATA['DEBUG'] = $DEBUG_TMPL;
-	$DEBUG_DATA['Id'] = '$Id: edit_order.php 4897 2014-02-06 08:16:56Z gullevek $';
 
 	// create main data array
 	$CONTENT_DATA = array_merge($HEADER, $DATA, $DEBUG_DATA);

www/admin/files.php

@@ -475,10 +475,6 @@ $cms->debug('file_upload', "ERROR: $error | INI FSize: ".ini_get("upload_max_fil
 
 	//------------------------------ processing data end
 
-	//------------------------------ debug data
-	$DEBUG_DATA['Id'] = '$Id: files.php 4897 2014-02-06 08:16:56Z gullevek $';
-	//------------------------------ debug data
-
 	//------------------------------ smarty start
 	require("smarty.inc");
 	//------------------------------ smarty end

www/admin/smarty.inc

@@ -86,7 +86,6 @@
 	// debug data, if DEBUG flag is on, this data is print out
 	$cms->DEBUG_DATA['debug_error_msg'] = $cms->running_time();
 	$cms->DEBUG_DATA['DEBUG'] = $DEBUG_TMPL;
-	$cms->DEBUG_DATA['Id'] = '$Id: smarty.inc 4897 2014-02-06 08:16:56Z gullevek $';
 
 	// create main data array
 	$cms->CONTENT_DATA = array_merge($cms->HEADER, $cms->DATA, $cms->DEBUG_DATA);

www/admin/table_arrays/array_edit_users.inc

@@ -32,6 +32,26 @@
 					"0" => "No"
 				)
 			),
+			"strict" => array (
+				"value" => $GLOBALS["strict"],
+				"output_name" => "Strict (Lock after errors)",
+				"type" => "binary",
+				"int" => 1,
+				"element_list" => array (
+					"1" => "Yes",
+					"0" => "No"
+				)
+			),
+			"locked" => array (
+				"value" => $GLOBALS["locked"],
+				"output_name" => "Locked (auto set if strict with errors)",
+				"type" => "binary",
+				"int" => 1,
+				"element_list" => array (
+					"1" => "Yes",
+					"0" => "No"
+				)
+			),
 			"admin" => array (
 				"value" => $GLOBALS["admin"],
 				"output_name" => "Admin",
@@ -98,12 +118,31 @@
 				"type" => "drop_down_db",
 				"query" => "SELECT edit_access_right_id, name FROM edit_access_right ORDER BY level"
 			),
+			"login_error_count" => array (
+				"output_name" => "Login error count",
+				"value" => $GLOBALS['login_error_count'],
+				"type" => "view",
+				"empty" => "0"
+			),
+			"login_error_date_last" => array (
+				"output_name" => "Last login error",
+				"value" => $GLOBALS['login_error_date_liast'],
+				"type" => "view",
+				"empty" => "-"
+			),
+			"login_error_date_first" => array (
+				"output_name" => "First login error",
+				"value" => $GLOBALS['login_error_date_first'],
+				"type" => "view",
+				"empty" => "-"
+			),
+			// planned delete lock flag
 			"protected" => array (
 				"value" => $GLOBALS["protected"],
 				"int" => 1
 			)
 		),
-		"load_query" => "SELECT edit_user_id, username, enabled, debug, db_debug FROM edit_user ORDER BY username",
+		"load_query" => "SELECT edit_user_id, username, enabled, debug, db_debug, strict, locked, login_error_count FROM edit_user ORDER BY username",
 		"table_name" => "edit_user",
 		"show_fields" => array (
 			array (
@@ -124,6 +163,20 @@
 				"binary" => array("Yes", "No"),
 				"before_value" => "DB Debug: "
 			),
+			array (
+				"name" => "strict",
+				"binary" => array("Yes", "No"),
+				"before_value" => "Strict: "
+			),
+			array (
+				"name" => "locked",
+				"binary" => array("Yes", "No"),
+				"before_value" => "Locked: "
+			),
+			array (
+				"name" => "login_error_count",
+				"before_value" => "Errors: "
+			)
 		),
 		"element_list" => array (
 			"edit_access_user" => array (

www/layout/admin/default/javascript/jquery.js

@@ -1 +1 @@
-jquery-1.8.2.min.js
+jquery-1.11.1.js

www/layout/admin/default/javascript/prototype.js

@@ -1 +1 @@
-prototype-1.7.1.0.js
+scriptaculous/prototype.js

www/layout/admin/default/javascript/scriptaculous/prototype.js

@@ -0,0 +1 @@
+prototype-1.7.2.0.js

www/layout/admin/default/templates/edit_elements.tpl

@@ -14,6 +14,9 @@
 		</td>
 		<td class="{$element.color}" class="normal">
 		{* here is depending on type the content data *}
+		{if $element.type == 'view'}
+			{$element.data.value}
+		{/if}
 		{if $element.type == 'binary' || $element.type == 'radio_array'}
 			{html_radios values=$element.data.value output=$element.data.output name=$element.data.name selected=$element.data.checked separator=$element.data.separator}
 		{/if}

www/libs/Class.Admin.Backend.inc

@@ -162,6 +162,8 @@
 
 			// get the session pages array
 			$pages = $_SESSION["PAGES"];
+			if (!is_array($pages))
+				$pages = array ();
 
 //$this->debug('pages', $this->print_ar($pages));
 

www/libs/Class.Basic.inc

@@ -97,6 +97,8 @@
 		public $class_info; // class info var
 
 		public $page_name;
+		public $host_name;
+		public $host_port;
 
 		private $error_id; // error ID for errors in classes
 		private $error_string; // error strings in classes (for error_id)
@@ -176,6 +178,7 @@
 
 			// set the page name
 			$this->page_name = $this->get_page_name();
+			$this->host_name = $this->get_host_name();
 
 			// set the paths matching to the valid file types
 			$this->data_path = array (
@@ -387,7 +390,7 @@
 				$this->fdebug_fp();
 				if ($enter)
 					$string .= "\n";
-				$string = "[".$this->print_time()."] [".$this->get_page_name()."] - ".$string;
+				$string = "[".$this->print_time()."] [".$this->get_page_name(2)."] - ".$string;
 				fwrite($this->debug_fp, $string);
 				$this->fdebug_fp();
 			}
@@ -451,7 +454,7 @@
 				if (!isset($this->error_msg[$level]))
 					$this->error_msg[$level] = '';
 				$error_string = '<div>';
-				$error_string .= '[<span style="font-weight: bold; color: #5e8600;">'.$this->print_time().'</span>] [<span style="font-weight: bold; color: #c56c00;">'.$level.'</span>] [<span style="color: #08b369;">'.$this->get_page_name().'</span>] [<span style="color: #0062A2;">'.$this->running_uid.'</span>] {<span style="font-style: italic; color: #928100;">'.get_class($this).'</span>} - '.$string;
+				$error_string .= '[<span style="font-weight: bold; color: #5e8600;">'.$this->print_time().'</span>] [<span style="font-weight: bold; color: #c56c00;">'.$level.'</span>] [<span style="color: #b000ab;">'.$this->host_name.'</span>] [<span style="color: #08b369;">'.$this->page_name.'</span>] [<span style="color: #0062A2;">'.$this->running_uid.'</span>] {<span style="font-style: italic; color: #928100;">'.get_class($this).'</span>} - '.$string;
 				$error_string .= "</div><!--#BR#-->";
 				if ($strip)
 				{
@@ -461,7 +464,7 @@
 					$string = preg_replace("/(<\/?)(\w+)([^>]*>)/", "", $string);
 				}
 				// same string put for print (no html crap inside)
-				$error_string_print = '['.$this->print_time().'] ['.$this->get_page_name().'] ['.$this->running_uid.'] {'.get_class($this).'} <'.$level.'> - '.$string;
+				$error_string_print = '['.$this->print_time().'] ['.$this->host_name.'] ['.$this->get_page_name(2).'] ['.$this->running_uid.'] {'.get_class($this).'} <'.$level.'> - '.$string;
 				$error_string_print .= "\n";
 				// write to file if set
 				$this->write_error_msg($level, $error_string_print);
@@ -797,8 +800,22 @@
 				return $atag.$email;
 		}
 
+		// METHOD get_host_name
+		// PARAMS none
+		// RETURN host name
+		// DESCRIPTION
+		// get the host name without the port as given by the SELF var
+		public static function get_host_name()
+		{
+			list($host_name, $port) = explode(":", $_SERVER['HTTP_HOST']);
+			$self->host_port = $port;
+			return $host_name;
+		}
+
 		// METHOD get_page_name
-		// PARAMS strip page file name extension, default is no
+		// PARAMS 1: strip page file name extension
+		//        0: keep filename as is
+		//        2: keep filename as is, but add dirname too
 		// RETURN filename
 		// DESCRIPTION
 		// get the page name of the curronte page:
@@ -806,8 +823,10 @@
 		{
 			// get the file info
 			$page_temp = pathinfo($_SERVER["PHP_SELF"]);
-			if ($strip_ext)
+			if ($strip_ext == 1)
 				return $page_temp['filename'];
+			elseif ($strip_ext == 2)
+				return $_SERVER['PHP_SELF'];
 			else
 				return $page_temp['basename'];
 		}

www/libs/Class.DB.Array.IO.inc

@@ -133,9 +133,9 @@
 		public function db_dump_array($write = 0)
 		{
 			reset($this->table_array);
-			while(list($spalte, $werte_array) = each($this->table_array))
+			while(list($column, $data_array) = each($this->table_array))
 			{
-				$string .= "<b>".$spalte."</b> -> ".$werte_array["value"]."<br>";
+				$string .= "<b>".$column."</b> -> ".$data_array["value"]."<br>";
 			}
 			// add output to internal error_msg
 			if ($write)
@@ -184,12 +184,12 @@
 		public function db_reset_array($reset_pk = 0)
 		{
 			reset($this->table_array);
-			while(list($spalte, $werte_array) = each($this->table_array))
+			while(list($column, $data_array) = each($this->table_array))
 			{
-				if (!$this->table_array[$spalte]["pk"])
-					unset($this->table_array[$spalte]["value"]);
+				if (!$this->table_array[$column]["pk"])
+					unset($this->table_array[$column]["value"]);
 				else if ($reset_pk)
-					unset($this->table_array[$spalte]["value"]);
+					unset($this->table_array[$column]["value"]);
 			}
 		}
 
@@ -208,27 +208,27 @@
 			$q .= $this->pk_name." = ".$this->table_array[$this->pk_name]["value"]." ";
 			// delete files and build FK query
 			reset($this->table_array);
-			while(list($spalte, $werte_array) = each($this->table_array))
+			while(list($column, $data_array) = each($this->table_array))
 			{
 				// suchen nach bildern und löschen ...
-				if ($this->table_array[$spalte]["file"] && file_exists($this->table_array[$spalte]["url"].$this->table_array[$spalte]["value"]))
+				if ($this->table_array[$column]["file"] && file_exists($this->table_array[$column]["url"].$this->table_array[$column]["value"]))
 				{
-					if (file_exists($this->table_array[$spalte]["path"].$this->table_array[$spalte]["value"]))
-						unlink($this->table_array[$spalte]["path"].$this->table_array[$spalte]["value"]);
-					$dateiname = str_replace("_tn", "", $this->table_array[$spalte]["value"]);
-					if (file_exists($this->table_array[$spalte]["path"].$dateiname))
-						unlink($this->table_array[$spalte]["path"].$dateiname);
+					if (file_exists($this->table_array[$column]["path"].$this->table_array[$column]["value"]))
+						unlink($this->table_array[$column]["path"].$this->table_array[$column]["value"]);
+					$dateiname = str_replace("_tn", "", $this->table_array[$column]["value"]);
+					if (file_exists($this->table_array[$column]["path"].$dateiname))
+						unlink($this->table_array[$column]["path"].$dateiname);
 				}
  
-				if ($this->table_array[$spalte]["fk"])
+				if ($this->table_array[$column]["fk"])
 				{
 					// zusammenstellen der FKs
 					if ($q_where) 
 						$q_where .= " AND ";
-					$q_where .= $spalte." = ".$this->table_array[$spalte]["value"];
+					$q_where .= $column." = ".$this->table_array[$column]["value"];
 				}
 				// allgemeines zurücksetzen des arrays
-				unset($this->table_array[$spalte]["value"]);
+				unset($this->table_array[$column]["value"]);
 			}
 
 			// attach fk row if there ...
@@ -257,18 +257,18 @@
 				return $this->table_array;
 			reset($this->table_array);
 			// create select part & addition FK part 
-			while (list($spalte, $werte_array)=each($this->table_array))
+			while (list($column, $data_array)=each($this->table_array))
 			{
 				if ($q_select) 
 					$q_select .= ", "; 
-				$q_select .= $spalte;
+				$q_select .= $column;
 
 				// check FK ...
-				if ($this->table_array[$spalte]["fk"] && $this->table_array[$spalte]["value"])
+				if ($this->table_array[$column]["fk"] && $this->table_array[$column]["value"])
 				{
 					if ($q_where)
 						$q_where .= " AND ";
-					$q_where .= $spalte .= " = ".$this->table_array[$spalte]["value"];
+					$q_where .= $column .= " = ".$this->table_array[$column]["value"];
 				}
 			}
  
@@ -285,23 +285,23 @@
 				if ($res = $this->db_fetch_array())
 				{  
 					reset($this->table_array);
-					while (list($spalte, $werte_array) = each($this->table_array))
+					while (list($column, $data_array) = each($this->table_array))
 					{
 						// wenn "edit" dann gib daten wie in DB zurück, ansonten aufbereiten für ausgabe
 						// ?? sollte das nicht draußen ??? man weis ja net was da drin steht --> is noch zu überlegen
-//						echo "EDIT: $edit | Spalte: $spalte | type: ".$this->table_array[$spalte]["type"]." | Res: ".$res[$spalte]."<br>";
+//						echo "EDIT: $edit | Spalte: $column | type: ".$this->table_array[$column]["type"]." | Res: ".$res[$column]."<br>";
 						if ($edit)
 						{
-							$this->table_array[$spalte]["value"] = $res[$spalte];
+							$this->table_array[$column]["value"] = $res[$column];
 							// if password, also write to hidden
-							if ($this->table_array[$spalte]["type"] == "password")
+							if ($this->table_array[$column]["type"] == "password")
 							{
-								$this->table_array[$spalte]["HIDDEN_value"] = $res[$spalte];
+								$this->table_array[$column]["HIDDEN_value"] = $res[$column];
 							}
 						}
 						else
 						{
-							$this->table_array[$spalte]["value"] = $this->convert_data(nl2br($res[$spalte]));
+							$this->table_array[$column]["value"] = $this->convert_data(nl2br($res[$column]));
 							// had to put out the htmlentities from the line above as it breaks japanese characters
 						}
 					}
@@ -335,58 +335,58 @@
 				$insert = 0;
 
 			reset ($this->table_array);
-			while (list($spalte, $werte_array) = each($this->table_array))
+			while (list($column, $data_array) = each($this->table_array))
 			{
 
 /********************************* START FILE *************************************/
 				// file upload
-				if ($this->table_array[$spalte]["file"])
+				if ($this->table_array[$column]["file"])
 				{
 					// falls was im tmp drinnen, sprich ein upload, datei kopieren, Dateinamen in db schreiben
 					// falls datei schon am server (physischer pfad), dann einfach url in db schreiben (update)
 					// falls in "delete" "ja" dann loeschen (und gibts eh nur beim update)
-					if ($this->table_array[$spalte]["delete"])
+					if ($this->table_array[$column]["delete"])
 					{
-						unset($this->table_array[$spalte]["delete"]);
-						if (file_exists($this->table_array[$spalte]["path"].$this->table_array[$spalte]["value"]))
-							unlink($this->table_array[$spalte]["path"].$this->table_array[$spalte]["value"]);
-						$dateiname = str_replace("_tn", "", $this->table_array[$spalte]["value"]); 
-						if (file_exists($this->table_array[$spalte]["path"].$dateiname))
-							unlink($this->table_array[$spalte]["path"].$dateiname);
-						$this->table_array[$spalte]["value"] = "";
+						unset($this->table_array[$column]["delete"]);
+						if (file_exists($this->table_array[$column]["path"].$this->table_array[$column]["value"]))
+							unlink($this->table_array[$column]["path"].$this->table_array[$column]["value"]);
+						$dateiname = str_replace("_tn", "", $this->table_array[$column]["value"]); 
+						if (file_exists($this->table_array[$column]["path"].$dateiname))
+							unlink($this->table_array[$column]["path"].$dateiname);
+						$this->table_array[$column]["value"] = "";
 					}
 					else
 					{
-						if ($this->table_array[$spalte]["tmp"] != "none" && $this->table_array[$spalte]["tmp"])
+						if ($this->table_array[$column]["tmp"] != "none" && $this->table_array[$column]["tmp"])
 						{
 							// Dateiname zusammenbasteln: org-name + _pkid liste + .ext
-							list($name, $ext) = explode(".",$this->table_array[$spalte]["dn"]);
+							list($name, $ext) = explode(".",$this->table_array[$column]["dn"]);
 
 							// mozilla, patch
-							$fn_name = explode("/", $this->table_array[$spalte]["dn"]);
-							$this->table_array[$spalte]["dn"] = $fn_name[count($fn_name)-1];
-							$filename_parts = explode(".", $this->table_array[$spalte]["dn"]);
+							$fn_name = explode("/", $this->table_array[$column]["dn"]);
+							$this->table_array[$column]["dn"] = $fn_name[count($fn_name)-1];
+							$filename_parts = explode(".", $this->table_array[$column]["dn"]);
 							$ext = end($filename_parts);
 							array_splice($filename_parts, -1, 1);
 							$name = str_replace(" ", "_", implode(".", $filename_parts));
 							//echo "PK: $pk_ids_file<br>";
 							$dateiname = $name.$pk_ids_file.".".$ext;
 							//echo "Dn: $dateiname";
-							copy($this->table_array[$spalte]["tmp"], $this->table_array[$spalte]["path"].$dateiname);
+							copy($this->table_array[$column]["tmp"], $this->table_array[$column]["path"].$dateiname);
 							// automatisch thumbnail generieren, geht nur mit convert (ImageMagic!!!), aber nur bei bild ..
 							if (strtolower($ext) == "jpeg" || strtolower($ext) == "jpg" || strtolower($ext) == "gif" || strtolower($ext) == "png")
 							{ 
 								$dateiname_tn = $name.$pk_ids_file."_tn.".$ext;
-								$eingang = $this->table_array[$spalte]["path"].$dateiname;
-								$ausgang = $this->table_array[$spalte]["path"].$dateiname_tn;
+								$eingang = $this->table_array[$column]["path"].$dateiname;
+								$ausgang = $this->table_array[$column]["path"].$dateiname_tn;
 								$com = "convert -geometry 115 $eingang $ausgang";
 								exec($com);
-								$this->table_array[$spalte]["value"] = $dateiname_tn;
+								$this->table_array[$column]["value"] = $dateiname_tn;
 							}
 							else
-								$this->table_array[$spalte]["value"] = $dateiname;
+								$this->table_array[$column]["value"] = $dateiname;
 						}
-						else if (file_exists($this->table_array[$spalte]["path"].$this->table_array[$spalte]["value"]))
+						else if (file_exists($this->table_array[$column]["path"].$this->table_array[$column]["value"]))
 						{
 							// mach gar nix, wenn bild schon da ???
 						}
@@ -394,16 +394,17 @@
 				} // file IF
 /********************************* END FILE **************************************/
 
-				if (!$this->table_array[$spalte]["pk"] && strlen($spalte) > 0 )
+				// do not write 'pk' (primary key) or 'view' values
+				if (!$this->table_array[$column]["pk"] && $this->table_array[$column]['type'] != 'view' && strlen($column) > 0 )
 				{
 					// for password use hidden value if main is not set
-					if ($this->table_array[$spalte]["type"] == "password" && !$this->table_array[$spalte]["value"])
-						$this->table_array[$spalte]["value"] = $this->table_array[$spalte]["HIDDEN_value"];
+					if ($this->table_array[$column]["type"] == "password" && !$this->table_array[$column]["value"])
+						$this->table_array[$column]["value"] = $this->table_array[$column]["HIDDEN_value"];
 					if (!$insert)
 					{
 						if (strlen($q_data)) 
 							$q_data .= ", ";
-						$q_data .= $spalte." = ";
+						$q_data .= $column." = ";
 					}
 					else
 					// this is insert
@@ -412,19 +413,19 @@
 							$q_data .= ", ";
 						if ($q_vars)
 							$q_vars .= ", ";
-						$q_vars .= $spalte;
+						$q_vars .= $column;
 						
 					}
 					// integer is different
-					if ($this->table_array[$spalte]["int"] || $this->table_array[$spalte]["int_null"])
+					if ($this->table_array[$column]["int"] || $this->table_array[$column]["int_null"])
 					{
-$this->debug('write_check', "[$spalte][".$this->table_array[$spalte]["value"]."] Foo: ".isset($this->table_array[$spalte]["value"])." | ".$this->table_array[$spalte]["int_null"]);
-						if (!$this->table_array[$spalte]["value"] && $this->table_array[$spalte]["int_null"])
+$this->debug('write_check', "[$column][".$this->table_array[$column]["value"]."] Foo: ".isset($this->table_array[$column]["value"])." | ".$this->table_array[$column]["int_null"]);
+						if (!$this->table_array[$column]["value"] && $this->table_array[$column]["int_null"])
 							$_value = 'NULL';
-						elseif (!isset($this->table_array[$spalte]["value"]))
+						elseif (!isset($this->table_array[$column]["value"]))
 							$_value = 0;
 						else
-							$_value = $this->table_array[$spalte]["value"];
+							$_value = $this->table_array[$column]["value"];
 						$q_data .= $_value;
 					}
 					else
@@ -433,9 +434,9 @@ $this->debug('write_check', "[$spalte][".$this->table_array[$spalte]["value"]."]
 						$q_data .= "'";
 						// if add slashes do convert & add slashes else write AS is
 						if ($addslashes)
-							$q_data .= $this->db_escape_string($this->convert_entities($this->table_array[$spalte]["value"]));
+							$q_data .= $this->db_escape_string($this->convert_entities($this->table_array[$column]["value"]));
 						else
-							$q_data .= addslashes($this->table_array[$spalte]["value"]);
+							$q_data .= addslashes($this->table_array[$column]["value"]);
 						$q_data .= "'";
 					}
 				}
@@ -445,14 +446,14 @@ $this->debug('write_check', "[$spalte][".$this->table_array[$spalte]["value"]."]
 			// get it at the end, cause now we can be more sure of no double IDs, etc
 			reset($this->table_array);
 			// create select part & addition FK part 
-			while (list($spalte, $werte_array) = each($this->table_array))
+			while (list($column, $data_array) = each($this->table_array))
 			{
 				// check FK ...
-				if ($this->table_array[$spalte]["fk"] && $this->table_array[$spalte]["value"])
+				if ($this->table_array[$column]["fk"] && $this->table_array[$column]["value"])
 				{
 					if ($q_where)
 						$q_where .= " AND ";
-					$q_where .= $spalte .= " = ".$this->table_array[$spalte]["value"];
+					$q_where .= $column .= " = ".$this->table_array[$column]["value"];
 				}
 			}
 

www/libs/Class.DB.IO.inc

@@ -312,7 +312,7 @@
 			$this->db_pwd = $db_config['db_pass'];
 			$this->db_host = $db_config['db_host'];
 			$this->db_port = array_key_exists('db_port', $db_config) ? $db_config['db_port'] : '5432';
-			$this->db_schema = array_key_exists('db_schema', $db_config) ? $db_config['db_schema'] : 'public';
+			$this->db_schema = array_key_exists('db_schema', $db_config) ? $db_config['db_schema'] : ''; // do not set to 'public' if not set, because the default is already public
 			$this->db_encoding = array_key_exists('db_encoding', $db_config) ? $db_config['db_encoding'] : '';
 			$this->db_type = 'db_'.$db_config['db_type'];
 			$this->db_ssl = array_key_exists('db_ssl', $db_config) ? $db_config['db_ssl'] : 'allow';
@@ -600,7 +600,7 @@
 		}
 
 		// METHOD _db_prepare_exec
-		// PARAMS query, primary key
+		// PARAMS query, primary key [if set to NULL no returning will be added]
 		// RETURN md5 OR boolean false on error
 		// DESC   sub function for db_exec and db_exec_async
 		//        * checks query is set
@@ -643,29 +643,32 @@
 			// if we do have an insert, check if there is no RETURNING pk_id, add it if I can get the PK id
 			if ($this->_check_query_for_insert($this->query, true))
 			{
-				if (!$pk_name)
-				{
-					// TODO: get primary key from table name
-					list($schema, $table) = $this->_db_return_table($this->query);
-					if (!$this->pk_name_table[$table])
-					{
-						$this->pk_name_table[$table] = $this->db_functions->_db_primary_key($table, $schema);
-					}
-					$pk_name = $this->pk_name_table[$table];
-				}
 				$this->pk_name = $pk_name;
-				if (!preg_match("/ returning /i", $this->query) && $this->pk_name)
+				if ($pk_name != 'NULL')
 				{
-					$this->query .= " RETURNING ".$this->pk_name;
-					$this->returning_id = true;
-				}
-				elseif (preg_match("/ returning (.*)/i", $this->query, $matches) && $this->pk_name)
-				{
-					if (!preg_match("/$this->pk_name/", $matches[1]))
+					if (!$pk_name)
 					{
-						$this->query .= " , ".$this->pk_name;
+						// TODO: get primary key from table name
+						list($schema, $table) = $this->_db_return_table($this->query);
+						if (!$this->pk_name_table[$table])
+						{
+							$this->pk_name_table[$table] = $this->db_functions->_db_primary_key($table, $schema);
+						}
+						$pk_name = $this->pk_name_table[$table];
+					}
+					if (!preg_match("/ returning /i", $this->query) && $this->pk_name)
+					{
+						$this->query .= " RETURNING ".$this->pk_name;
 						$this->returning_id = true;
 					}
+					elseif (preg_match("/ returning (.*)/i", $this->query, $matches) && $this->pk_name)
+					{
+						if (!preg_match("/$this->pk_name/", $matches[1]))
+						{
+							$this->query .= " , ".$this->pk_name;
+							$this->returning_id = true;
+						}
+					}
 				}
 			}
 			// for DEBUG, only on first time ;)
@@ -731,7 +734,7 @@
 					// if not select do here
 					// count affected rows
 					$this->num_rows = $this->db_functions->_db_affected_rows($this->cursor);
-					if ($this->_check_query_for_insert($this->query, true))
+					if ($this->_check_query_for_insert($this->query, true) && $this->pk_name != 'NULL')
 					{
 						// set insert_id
 						if (!$this->returning_id)
@@ -1047,6 +1050,7 @@
 		//                 (if this was not set, method will quit with a 0 (failure)
 		//        pk_name -> optional primary key name, for insert id return if the pk name is very different
 		//                   if pk name is table name and _id, pk_name is not needed to be set
+		//                   if NULL is given here, no RETURNING will be auto added
 		// RETURN cursor for this query
 		// DESC   executes the query and returns & sets the internal cursor
 		//        fruthermore this functions also sets varios other vars 

www/libs/Class.Form.Generate.inc

@@ -25,7 +25,8 @@
 	*        "fk" => 1/0 - sets the foreign key (do not use at the moment ... buggy ;)
 	*        "mandatory" => 1/0 - triggers * in output, but nor error check
 	*        "output_name" => "text" - text put as label for the element
-	*        "type" => "text/textarea/date/drop_down_db/drop_down_array/drop_down_db_input/drop_down_db_same_db/radio_array/binary/hidden/file/password"
+	*        "type" => "view/text/textarea/date/drop_down_db/drop_down_array/drop_down_db_input/drop_down_db_same_db/radio_array/binary/hidden/file/password"
+	*					View is special, it just prints out the data as is, will not be saved
 	*                   1) more will come
 	*                   2) keep in mind that binary will not be checked, as it is always set to a value (default is "no")
 	*        ---- the next four fields are only NECESSARY (!!!) for drop_down_db_input
@@ -44,6 +45,7 @@
 	*        "error_check" => "custom/email/date/number/unique" - 1) more will come
 	*        "error_regex" => "regex" - if error_check is custom regex here
 	*        "error_example" => "text" - example input text for error_check (only custom right now) 
+	*        "empty" => "value/text" - ONLY for view. If no data found, set this value
 	*        --- file:
 	*        "save_dir" => "directory where it should be saved to
 	*        "accept_type" => "mime types accepted (mime/text,mime/jpeg ... etc)"
@@ -689,6 +691,11 @@
 				$output_name .= ' *';
 			// create right side depending on "definiton" in table_array
 			$type = $this->table_array[$element_name]["type"];
+			// view only output
+			if ($this->table_array[$element_name]["type"] == "view")
+			{
+				$data['value'] = !$this->table_array[$element_name]["value"] ? $this->table_array[$element_name]['empty'] : $this->table_array[$element_name]["value"];
+			}
 			// binary true/false element
 			if ($this->table_array[$element_name]["type"] == "binary")
 			{

www/libs/Class.Login.inc

@@ -68,7 +68,6 @@
 		public $login; // pressed login
 		private $username; // login name
 		private $password; // login password
-		private $current_page_name; // the page from which this login is called
 		private $logout; // logout button
 		private $login_error; // login error code, can be matched to the array login_error_msg, which holds the string
 		private $password_change = false; // if this is set to true, the user can change passwords
@@ -154,14 +153,15 @@
 			$this->pw_new_password_confirm = $_POST['pw_new_password_confirm'];
 			// logout target (from config)
 			$this->logout_target = LOGOUT_TARGET;
-			// get the page name
-			// page_name aus PHP_SELF strippen
-			$this->current_page_name = $this->get_page_name();
 			// disallow user list for password change
 			$this->pw_change_deny_users = array ('admin');
 			// set flag if password change is okay
 			if (defined('PASSWORD_CHANGE'))
 				$this->password_change = PASSWORD_CHANGE;
+			// max login counts before error reporting
+			$this->max_login_error_count = 10;
+			// users that never get locked, even if they are set strict
+			$this->lock_deny_users = array ('admin');
 
 			// internal
 			$this->class_info["login"] = array(
@@ -243,7 +243,7 @@
 				else
 				{
 					// we have to get the themes in here too
-					$q = "SELECT eu.edit_user_id, username, password, eu.edit_group_id, eg.name AS edit_group_name, admin, ";
+					$q = "SELECT eu.edit_user_id, username, password, eu.edit_group_id, eg.name AS edit_group_name, admin, eu.login_error_count, eu.login_error_date_last, eu.login_error_date_first, eu.strict, eu.locked, ";
 					$q .= "debug, db_debug, ";
 					$q .= "eareu.level AS user_level, eareu.type AS user_type, ";
 					$q .= "eareg.level AS group_level, eareg.type AS group_type, ";
@@ -267,13 +267,33 @@
 					}
 					else
 					{
+						// if login errors is half of max errors and the last login error was less than 10s ago, forbid any new login try
+
 						// check with what kind of prefix the password begins:
 						// $2a$ or $2y$: BLOWFISCH
 						// $1$: MD5
 						// $ and one alphanumeric letter, 13 chars long, but nor $ at the end: STD_DESC
 						// if no $ => normal password
 						// NOW, if we have a password encoded, but not the correct encoder available, throw special error
-						if ((preg_match("/^\\$2(a|y)\\$/", $res['password']) && CRYPT_BLOWFISH != 1) || (preg_match("/^\\$1\\$/", $res['password']) && CRYPT_MD5 != 1) || (preg_match("/^\\$[0-9A-Za-z.]{12}$/", $res['password']) && CRYPT_STD_DES != 1))
+
+						// check flow
+						// - user is enabled
+						// - user is not locked
+						// - password is readable
+						// - encrypted password matches
+						// - plain password matches
+
+						// user is enabled
+						if (!$res["enabled"])
+						{
+							$this->login_error = 104;
+						}
+						// user is locked, either set or auto set
+						elseif ($res['locked'])
+						{
+							$this->login_error = 105;
+						}
+						elseif ((preg_match("/^\\$2(a|y)\\$/", $res['password']) && CRYPT_BLOWFISH != 1) || (preg_match("/^\\$1\\$/", $res['password']) && CRYPT_MD5 != 1) || (preg_match("/^\\$[0-9A-Za-z.]{12}$/", $res['password']) && CRYPT_STD_DES != 1))
 						{
 							$this->login_error = 9999; // this means password cannot be decrypted because of missing crypt methods
 						}
@@ -287,11 +307,6 @@
 						{
 							$this->login_error = 1012;
 						}
-						// user is enabled
-						elseif (!$res["enabled"])
-						{
-							$this->login_error = 104;
-						}
 						// nromal user processing
 						else
 						{
@@ -316,6 +331,12 @@
 								$_SESSION["LANG"] = $res["lang_short"];
 								$_SESSION["DEFAULT_CHARSET"] = $res["lang_iso"];
 								$_SESSION["DEFAULT_LANG"] = $res["lang_short"].'_'.strtolower(str_replace('-', '', $res["lang_iso"]));
+								// reset any login error count for this user
+								if ($res['login_error_count'] > 0)
+								{
+									$q = "UPDATE edit_user SET login_error_count = 0, login_error_date_last = NULL, login_error_date_first = NULL WHERE edit_user_id = ".$res['edit_user_id'];
+									$this->db_exec($q);
+								}
 								$pages = array();
 								$edit_page_ids = array();
 								// set pages access
@@ -407,9 +428,27 @@
 								$_SESSION["UNIT"] = $unit_access;
 								$_SESSION["UNIT_ACL_LEVEL"] = $unit_acl;
 								$_SESSION['EAID'] = $eauid;
-								// load edit access list for this user
 							} // user has permission to THIS page
-						} // user was not enabled
+						} // user was not enabled or other login error
+						if ($this->login_error)
+						{
+							if ($res['login_error_count'] == 0)
+								$login_error_date_first = ', login_error_date_first = NOW()';
+							// update login error count for this user
+							$q = "UPDATE edit_user SET login_error_count = login_error_count + 1, login_error_date_last = NOW() $login_error_date_first WHERE edit_user_id = ".$res['edit_user_id'];
+							$this->db_exec($q);
+							// totally lock the user if error max is reached
+							if ($res['login_error_count'] + 1 > $this->max_login_error_count)
+							{
+								// do some alert reporting in case this error is too big
+								// if strict is set, lock this user
+								// this needs manual unlocking by an admin user
+								if ($res['strict'] && !in_array($this->username, $this->lock_deny_users))
+								{
+									$q = "UPDATE edit_user SET locked = 1 WHERE edit_user_id = ".$res['edit_user_id'];
+								}
+							}
+						}
 					} // user was not found
 				} // if not username AND password where given
 				// if there was an login error, show login screen
@@ -425,19 +464,19 @@
 		// PARAMS: none
 		// RETUNR none
 		// DESC  : for every page the user access this script checks if he is allowed to do so
-		private function login_check_permissions()
+		public function login_check_permissions()
 		{
 			if ($this->euid && $this->login_error != 103)
 			{
 				$q = "SELECT filename ";
 				$q .= "FROM edit_page ep, edit_page_access epa, edit_group eg, edit_user eu ";
 				$q .= "WHERE ep.edit_page_id = epa.edit_page_id AND eg.edit_group_id = epa.edit_group_id AND eg.edit_group_id = eu.edit_group_id ";
-				$q .= "AND eu.edit_user_id = ".$this->euid." AND filename = '".$this->current_page_name."' AND eg.enabled = 1 AND epa.enabled = 1";
+				$q .= "AND eu.edit_user_id = ".$this->euid." AND filename = '".$this->page_name."' AND eg.enabled = 1 AND epa.enabled = 1";
 				$res = $this->db_return_row($q);
 				// unset mem limit if debug is set to 1
 //				if (($GLOBALS["DEBUG_ALL"] || $GLOBALS["DB_DEBUG"] || $_SESSION["DEBUG_ALL"] || $_SESSION["DB_DEBUG"]) && ini_get('memory_limit') != -1)
 //					ini_set('memory_limit', -1);
-				if ($res["filename"] == $this->current_page_name)
+				if ($res["filename"] == $this->page_name)
 				{
 					$this->permission_okay = 1;
 				}
@@ -447,13 +486,15 @@
 					$this->permission_okay = 0;
 				}
 			}
+			// if called from public, so we can check if the permissions are ok
+			return $this->permission_okay;
 		}
 
 		// METHOD: login_logout_user
 		// PARAMS: none
 		// RETURN: none
 		// DESC  : if a user pressed on logout, destroyes session and unsets all global vars
-		private function login_logout_user()
+		public function login_logout_user()
 		{
 			if ($this->logout || $this->login_error)
 			{
@@ -495,7 +536,7 @@
 		//         * if an account ACL is set, set this parallel, account ACL overrides user ACL if it applies
 		//         * if edit access ACL level is set, use this, else use page
 		//         set all base ACL levels as a list keyword -> ACL number
-		private function login_set_acl()
+		public function login_set_acl()
 		{
 			// set the mastser user id
 			$this->acl['info']['euid'] = $_SESSION['EUID'];
@@ -787,6 +828,7 @@
 				"102" => $this->l->__("Fatal Error: <b>Login Failed - Please enter username and password</b>"),
 				"103" => $this->l->__("Fatal Error: <b>You do not have the rights to access this Page</b>"),
 				"104" => $this->l->__("Fatal Error: <b>Login Failed - User not enabled</b>"),
+				"105" => $this->l->__("Fatal Error: <b>Login Failed - User is locked</b>"),
 				"220" => $this->l->__("Fatal Error: <b>Password change - The user could not be found</b>"), // actually this is an illegal user, but I mask it
 				'200' => $this->l->__("Fatal Error: <b>Password change - Please enter username and old password</b>"),
 				"201" => $this->l->__("Fatal Error: <b>Password change - The user could not be found</b>"),
@@ -943,7 +985,7 @@ EOM;
 			$q .= "(username, password, euid, event_date, event, error, data, data_binary, page, ";
 			$q .= "ip, user_agent, referer, script_name, query_string, server_name, http_host, http_accept, http_accept_charset, http_accept_encoding, session_id, ";
 			$q .= "action, action_id, action_yes, action_flag, action_menu, action_loaded, action_value, action_error) ";
-			$q .= "VALUES ('".$this->db_escape_string($username)."', '".$this->db_escape_string($password)."', ".(($this->euid) ? $this->euid : 'NULL').", NOW(), '".$this->db_escape_string($event)."', '".$this->db_escape_string($error)."', '".$this->db_escape_string($data)."', '".$data_binary."', '".$this->current_page_name."', ";
+			$q .= "VALUES ('".$this->db_escape_string($username)."', '".$this->db_escape_string($password)."', ".(($this->euid) ? $this->euid : 'NULL').", NOW(), '".$this->db_escape_string($event)."', '".$this->db_escape_string($error)."', '".$this->db_escape_string($data)."', '".$data_binary."', '".$this->page_name."', ";
 			foreach (array('REMOTE_ADDR', 'HTTP_USER_AGENT', 'HTTP_REFERER', 'SCRIPT_FILENAME', 'QUERY_STRING', 'SERVER_NAME', 'HTTP_HOST', 'HTTP_ACCEPT', 'HTTP_ACCEPT_CHARSET', 'HTTP_ACCEPT_ENCODING') as $server_code)
 			{
 				if (array_key_exists($server_code, $_SERVER))