ezs.c File Reference

#include "cgi.h"

Include dependency graph for ezs.c:

Go to the source code of this file.

Defines
#define	USE_MUTEX
Functions
int	ODBCRunScript (char *argv0, EZSSTREAM *result, char *dbname, CGINameValue *config, CGINameValue *Params, char *search)
char *	itos (unsigned int value, char *p)
void	GenerateSessionID (char *session, unsigned int i)
void	GenerateUniqueID (char *newsession, char *hash)
int	CheckFileName (char *Name, char *AllowedEndings)
int	DeleteOldRecords (FILE *database, CGINameValue *header, CGINameValue *Params)
int	FindUserRecordASC (char *idfields, FILE *database, CGINameValue *header, CGINameValue *Params)
CGINameValue *	LoadUserDataASC (CGINameValue *config, char *argv0, char *dbname, CGINameValue *Params, int *err)
CGINameValue *	LoadUserDataSQL (CGINameValue *config, char *argv0, char *dbname, CGINameValue *Params, int *err)
CGINameValue *	LoadUserData (CGINameValue *config, char *argv0, char *dbname, CGINameValue *Params, int *err)
static char *	JSShowPage (ScriptEnvironment *Env, char *cmd, int argc, char **argv, CGINameValue *Params)
static char *	JSUniqueId (ScriptEnvironment *Env, char *cmd, int argc, char **argv, CGINameValue *Params)
static char *	JSTimeDate (ScriptEnvironment *Env, char *cmd, int argc, char **argv, CGINameValue *Params)
static char *	JSTimeTime (ScriptEnvironment *Env, char *cmd, int argc, char **argv, CGINameValue *Params)
static char *	JSSendMail (ScriptEnvironment *Env, char *cmd, int argc, char **argv, CGINameValue *Params)
static int	SortFunction (const void *a0, const void *b0)
void	SortNVP (CGINameValue *list)
static char *	JSRankSort (ScriptEnvironment *Env, char *cmd, int argc, char **argv, CGINameValue *Params)
static char *	JSRankIndex (ScriptEnvironment *Env, char *cmd, int argc, char **argv, CGINameValue *Params)
static char *	JSSQLEscape (ScriptEnvironment *Env, char *cmd, int argc, char **argv, CGINameValue *Params)
int	ValidatePage (char *argv0, EZSSTREAM *htmlout, char *dbname, CGINameValue *Config, CGINameValue *Params, char *page)
int	ValidateBack (char *argv0, EZSSTREAM *htmlout, char *dbname, CGINameValue *Config, CGINameValue *Params, char *page)
int	ShowForm (char *argv0, EZSSTREAM *htmlout, char *formname, CGINameValue *Params)
int	ShowFormPage (char *argv0, EZSSTREAM *htmlout, char *dbname, CGINameValue *Params, char *history, char *curpage)
int	CalcCountSummary (CGINameValue *Params, char *fieldname)
int	TryODBC (SQLDB *db, char *argv0, char *dbname, CGINameValue *config, CGINameValue *Params, char *script)
int	GetRespcount (char *argv0, char *dbname)
int	SetRespcount (char *argv0, char *dbname, int i)
int	SaveData (char *argv0, char *dbname, CGINameValue *Params, CGINameValue *config, int SubtractOldStats)
int	PrintFinish (char *argv0, EZSSTREAM *htmlout, char *dbname, CGINameValue *config, CGINameValue *Params, int ret)
void	ShowProgramStatus (EZSSTREAM *htmlout, int Security)
int	SecurityError (EZSSTREAM *htmlout, CGINameValue *Params, char *dbname, char *action, int error)
int	Login (EZSSTREAM *htmlout, int Security, char *dbname, CGINameValue *Params, char *argv0, CGINameValue *config)
int	PrintInstructions (EZSSTREAM *htmlout)
int	CGImain (char *argv0, CGINameValue *Params, EZSSTREAM *htmlout)

---

Define Documentation

#define USE_MUTEX

---

Function Documentation

int CalcCountSummary (  CGINameValue *  Params, char *  fieldname )

Definition at line 1082 of file ezs.c. References CGIFREE, GetField(), HasToken(), CGINameValue::name, strdup(), and CGINameValue::value. Referenced by SaveData(), and UpdateStatistics(). { CGINameValue* start; start = GetField(Params,fieldname); /* Q1 or Q1_A */ if (start) if (start->value) return *start->value ? 1 : 0; if (strchr(fieldname,'_')) /* is that specific answer set? Q1_1 or Q1=1&Q1=2 */ { char* name = strdup(fieldname); char* code = strchr(name,'_'); size_t l; *code=0; l = strlen(name); start = GetField(Params,name); if (!start) {CGIFREE(name); return 0; } /* no answers to this question */ while (start->name) /* related field values are adjacent */ { if (strncmp(start->name,name,l)) break; if (start->value) if ((start->name[l] == '_' || start->name[l] == 0) && *start->value) if (HasToken(start->value,code+1,0)) {CGIFREE(name); return 1;} start++; } CGIFREE(name); } else /* is any Q1 or Q1_1 set? */ { start = GetField(Params,fieldname); if (!start) { size_t l = strlen(fieldname); start = Params; while (start->name) { if (!strncmp(start->name,fieldname,l)) if (start->value) if ((start->name[l] == '_' || start->name[l] == 0) && *start->value) return 1; start++; } } } return 0; }

int CGImain (  char *  argv0, CGINameValue *  Params, EZSSTREAM *  htmlout )

_PAGE stores the page currently being viewed _PAGENEXT is a FIFO of the pages to go to. New pages are appended _PAGEBACK is a LIFO for the "Previous" button. New pages are prepended For both of these lists, the "current" value is taken from the beginning of the comma-delimited values. Definition at line 2041 of file ezs.c. References BufferWrite(), CGI_ALLOW_APPEND, CGI_ALLOW_NONE, CGI_ALLOW_REPORT, CGI_ALLOW_UPDATE, CGIFCLOSE, CGIFOPEN, CGIFREE, CGIMALLOC, ClearToken(), CopyBuffer(), DebugShowNVP(), DeleteBuffer(), DeleteNVP(), ExpandLocalPath(), FileOpen(), GenerateUniqueID(), GetField(), GetFieldValue, GetSecurityFlags(), GetSetting(), GetTime(), HasToken(), HTMLEscape(), HTMLWrite(), LoadUserData(), LogError(), Login(), MAXPATH, NewBuffer(), NULL, NULLSTR, PopList(), PopList2(), PrintFinish(), PrintInstructions(), ReadINIFileSection(), ReadUntilChar(), RenameField(), RunReport(), SaveData(), SecurityError(), SendCGIHeader(), SendMail(), SetFieldValue(), ShowForm(), ShowFormPage(), ShowProgramStatus(), strdup(), strdup3(), stricmp(), strnicmp(), ValidateBack(), and ValidatePage(). {/* CGIMain */ char * dbname = GetFieldValue(Params,"DATABASE"); char * password = GetFieldValue(Params,"_PASSWORD"); char * action = GetFieldValue(Params,"_ACTION"); char * page = GetFieldValue(Params,"_PAGE"); char * session = GetFieldValue(Params,"_SESSION"); char * ErrorMessage = ""; char firstPW[64]; CGINameValue* config = NULL; int ret = 0; int hasuid; int needslogin; int multipage; int hasSession; /* the security level depends on what you're trying to do */ int Security = GetSecurityFlags(argv0,GetFieldValue(Params,"HOST"),dbname,password); if (Security == CGI_ALLOW_NONE || !Params || !*dbname) { SendCGIHeader(htmlout,NULL); return PrintInstructions(htmlout); } /* an error here could be a security warning or a buffer overrun attempt * we don't want to pipe it through the mail, since long values could * be used to cause a buffer overrun in sendmail. We also don't want to * send email that would flood the administrator's mailbox. */ if (*page) if (strlen(page) < 5) { SendCGIHeader(htmlout,NULL); HTMLWrite(htmlout,"Bad page name: "); HTMLEscape(htmlout,page); return 103; } if (!ret) if (strlen(dbname)>128) ret = 102; if (!ret) if (strlen(password)>128) ret = 102; if (!ret) if (strlen(action)>128) ret = 102; if (!ret) if (strlen(page)>128) ret = 102; if (ret) { return ret; } else { char fn[MAXPATH]; ExpandLocalPath(argv0,fn,dbname,".ini"); /* If you want to use a fixed, obfuscated .ini file name, do it here */ /* ExpandLocalPath(argv0,fn,"my secret file name.ini","") */ config = ReadINIFileSection(fn,"DATABASE",0); if (config == NULL) { SendCGIHeader(htmlout,NULL); PrintInstructions(htmlout); HTMLWrite(htmlout,argv0); HTMLWrite(htmlout,": A configuration file for the database \"<b>"); HTMLEscape(htmlout,dbname); HTMLWrite(htmlout,"</b>\" was not found. Please check your spelling and server setup and try again.<P>\n"); HTMLWrite(htmlout,"Cannot access file ("); HTMLEscape(htmlout,dbname); HTMLWrite(htmlout,".ini)"); LogError("\nCould not open config file "); LogError(fn); return 21; } } dbname = strdup(dbname); action = strdup(action); password = strdup(password); page = strdup(page); /* fix up the form data. Password doesn't get erased -- might need it later.*/ RenameField(Params,"DATABASE",0); RenameField(Params,"_ACTION",0); /* options that we'll need to refer to later */ if (!atoi(GetSetting(config,"ACTIVE","1"))) { SendCGIHeader(htmlout,NULL); PrintInstructions(htmlout); } needslogin = atoi(GetFieldValue(config,"HASUID")); hasSession = *GetFieldValue(config,"_SESSION"); multipage = atoi(GetFieldValue(config,"MULTIPAGE")); { char*c; firstPW[0]=0; strncpy(firstPW,GetSetting(config,"IDFIELDS","IFMUID"),sizeof(firstPW)); firstPW[sizeof(firstPW)-1]=0; c = strchr(firstPW,','); if (c) *c=0; hasuid = (*GetFieldValue(Params,firstPW) != 0); } if (!*session) { char newsession[48]; GenerateUniqueID(newsession, GetFieldValue(config,"HOST")); SetFieldValue(Params,"_SESSION",newsession); } /* to limit the number of responses, set "MAXRESPONSES=100" and "MAXMESSAGE=http://..." * in the project's .ini file. On Windows, a file called "counts.ini" will be created, * and the number of responses received in each project saved in that file. On UNIX, * it's dbname.respcount, and the file is binary. When the max number of responses * have been finally submitted, the project will close, and this CGI program will no * longer work, instead directing respondents to a web page with an explanation or displaying * a message. */ { int maxResponses = atoi(GetSetting(config,"MAXRESPONSES","")); if (maxResponses != 0) { char filename[MAXPATH]; int i = 0; #if defined(XP_WIN) &&!defined(__WINCE__) ExpandLocalPath(argv0,filename,"ezscounts.ini",0); #ifdef UNICODE i = GetPrivateProfileIntA("responses",dbname,0,filename); #else i = GetPrivateProfileInt("responses",dbname,0,filename); #endif #else ExpandLocalPath(argv0,filename,dbname,".respcount"); { FILE * f; f = CGIFOPEN(filename,"rb"); if (f) { fread(&i,sizeof(i),1,f); CGIFCLOSE(f);} } #endif if (i >= maxResponses) { ErrorMessage = GetSetting(config,"MAXMESSAGE","Sorry, this form is no longer available."); ret = 12; } } } if (!ret) { char* stoptime = GetFieldValue(config,"STOPDATE"); if (*stoptime) { char now[16]; size_t l = strlen(stoptime); GetTime(now, now+8,0); if (l < sizeof(now)) now[l]=0; if (strcmp(now,stoptime)>0) ret = 13; } } if (!ret) { char* active = GetFieldValue(config,"ACTIVE"); if (*active) if (!atoi(active)) ret = 13; } if (!ret) /* check password if no error set */ { char* pwdfile = GetSetting(config,"PWDFILE",""); if (*pwdfile) { char* userid = GetFieldValue(Params,firstPW); if (!*userid) { ret = 11; } else { FILE* pwlist; char line[128]; pwlist = CGIFOPEN(pwdfile,"rt"); ret = 11; if (pwlist) { while (ReadUntilChar(pwlist,line,128," \t\r\n",0) > 0) { if (!stricmp(line,userid)) /* if the password is found, clear the error */ {ret = 0; break;} } CGIFCLOSE(pwlist); } /* search the list */ } } } if (ret) { switch(ret) { case 11: ErrorMessage = GetSetting(config,"PWDMESSAGE","Sorry, you need a password to access this form."); break; case 12: case 13: ErrorMessage = GetSetting(config,"MAXMESSAGE","Sorry, this form is no longer available."); } } else { if (!stricmp(action,"REPORT")) { if (!(Security & CGI_ALLOW_REPORT)) { SendCGIHeader(htmlout,NULL); ret = SecurityError(htmlout,Params,dbname,action,CGI_ALLOW_REPORT); } else { char *c; FILE *f; c = GetSetting(config,"REPORT2",NULLSTR); /*if (!*c) c = GetSetting(config,"REPORT",NULLSTR); */ /* use the filename from the config file, but in the current directory */ f = *c ? FileOpen(argv0,c,"") : 0; /* 4d. Display the report you set above */ SendCGIHeader(htmlout,NULL); if (f) { RunReport(argv0,htmlout,f,Params,NULL,NULL,0,NULL); CGIFCLOSE(f); ret = 0; } else HTMLWrite(htmlout,"Report file not found"); } } else if (!*action || !stricmp(action,"START")) /* probably starting a form or loggin in */ { char* form = GetFieldValue(config,"FORM"); SendCGIHeader(htmlout,NULL); if (needslogin) {/* load stored data from the database */ if (hasuid || (!stricmp(action,"START") && (Security &CGI_ALLOW_APPEND))) /* Do we already have login info? Or we'll allow them to enter it later*/ { CGINameValue* userdata = NULL; if (hasuid) userdata = LoadUserData(config,argv0,dbname,Params,&ret); if (!ret) { if (userdata != NULL) { char* next = ""; char* pageback = ""; if (atoi(GetFieldValue(config,"FORGETPAGES"))==0) { next = GetFieldValue(userdata,"_PAGE"); pageback = GetFieldValue(userdata,"_PAGEBACK"); } if (!*next) next = GetSetting(config,"STARTPAGE","page0"); if (Security & CGI_ALLOW_UPDATE) ret = multipage ? ShowFormPage(argv0,htmlout,dbname,userdata,pageback,next) : ShowForm(argv0,htmlout,form,userdata); else { ret = SecurityError(htmlout,Params,dbname,action,CGI_ALLOW_UPDATE); Login(htmlout,Security,dbname,Params,argv0,config); } DeleteNVP(userdata); } else if (!ret) /* no existing data: start a new form */ { if (Security & CGI_ALLOW_APPEND) ret = multipage ? ShowFormPage(argv0,htmlout,dbname,Params,"",GetSetting(config,"STARTPAGE","page0")) : ShowForm(argv0,htmlout,form,Params); else { ret = SecurityError(htmlout,Params,dbname,action,CGI_ALLOW_APPEND); Login(htmlout,Security,dbname,Params,argv0,config); } } } } /* has uid */ else /* log in page, come back to start later. */ { Login(htmlout,Security,dbname,Params,argv0,config); } } /* needs login */ else {/* show the first page */ ret = multipage ? ShowFormPage(argv0,htmlout,dbname,Params,"",GetSetting(config,"STARTPAGE","page0")) : ShowForm(argv0,htmlout,form,Params); } } /* !*action */ else if (multipage && !stricmp(action,"NEXT")) {/* go on to the next page, and add the current page to the history*/ char* pagenext; char* pageback; char* skip; skip = GetFieldValue(Params,"_PAGESKIP"); SendCGIHeader(htmlout,NULL); /* check validation, but save first */ if (atoi(GetFieldValue(config,"SAVEPAGE")) && stricmp(skip,"(save)")) SaveData(argv0, dbname, Params, config, hasSession); if (*page) ValidatePage(argv0,htmlout,dbname,config,Params,page); pagenext = GetFieldValue(Params,"_PAGENEXT"); pageback = GetFieldValue(Params,"_PAGEBACK"); skip = GetFieldValue(Params,"_PAGESKIP"); /* since we've been there, we can remove it from the future list */ while (HasToken(pagenext,page,0)) ClearToken(pagenext,page); if (*GetFieldValue(Params,"_PAGEWARN")) /* show the page again */ {/* don't add anything to the history list */ ret = ShowFormPage(argv0,htmlout,dbname,Params,pageback,page); } else { /* if this page was successful, go to the SUBMIT validation */ if (!strcmp(skip,"(save)")) goto atSaveData; if (*skip && *pagenext) /* put the skip pages at the beginning of the list */ { char * p; if (HasToken(pagenext,skip,0)) ClearToken(pagenext,skip); p = strdup3(skip," ",pagenext); SetFieldValue(Params,"_PAGENEXT",p); CGIFREE(p); } else if (*skip) SetFieldValue(Params,"_PAGENEXT",skip); /* add the page we came from to the history */ pageback = strdup3(page,",",pageback); /* what's the next page in the list? */ CGIFREE(page); page = strdup(PopList(Params,"_PAGENEXT",0)); /* skipping to several pages, to BACK should treat _PAGENEXT specially until it's done with this page */ if (strchr(skip,',')) page[0] = 'P'; /* make copies of pagenext and pageback, which may get erased by ShowFormPage */ ret = ShowFormPage(argv0,htmlout,dbname,Params,pageback,page); CGIFREE(pageback); } } else if (multipage && !stricmp(action,"BACK")) {/* go back a page, and don't add the current page to the history */ char * pageback, * pagenext; SendCGIHeader(htmlout,NULL); ValidateBack(argv0,htmlout,dbname,config,Params,page); pageback = GetFieldValue(Params,"_PAGEBACK"); pagenext = GetFieldValue(Params,"_PAGENEXT"); if (*GetFieldValue(Params,"_PAGEWARN")) /* show the page again */ {/* don't add anything to the history list */ ret = ShowFormPage(argv0,htmlout,dbname,Params,pageback,page); } else { /* remove the last set of pages that were added */ /* when we go forward again, the page that sent us here will be re-added to the future list by the validation script but only if we're returning from the first page in a skip list. Hmm, tricky */ if (strchr(pagenext,' ')) /* we're in a skip subroutine */ { if (toupper(page[0]) == 'P') /* going back from the first page in the subroutine, so clear the future list */ PopList(Params,"_PAGENEXT",' '); else { /* we're going to need to remember this page */ char * p = strdup3(page,",",pagenext); SetFieldValue(Params,"_PAGENEXT",p); CGIFREE(p); } } /* where are we going back to? */ page = strdup(PopList2(pageback,0)); ret = ShowFormPage(argv0,htmlout,dbname,Params,pageback,page); } } else if (!stricmp(action,"SAVE") || !stricmp(action,"SUBMIT")) {/* Save & Quit or done with the form */ /* save ODBC data first, so we get the key value */ /* Check user id. Are we allowed to enter data? */ atSaveData: { int allowsave = 1; if (!(Security & CGI_ALLOW_APPEND)) {/* look for an existing record before saving */ if (!(Security & CGI_ALLOW_UPDATE)) { SendCGIHeader(htmlout,NULL); ret = SecurityError(htmlout,Params,dbname,action,CGI_ALLOW_APPEND); } else { CGINameValue* userdata; userdata = LoadUserData(config,argv0,dbname,Params,&ret); if (!userdata) { SendCGIHeader(htmlout,NULL); ret = SecurityError(htmlout,Params,dbname,action,CGI_ALLOW_APPEND); } DeleteNVP(userdata); } } /* security */ if (!ret) /* OK so far */ { /* Runs the SUBMIT validation page, which may save or modify field values */ /* Last page -- also run the particular page's validation */ if (!GetField(Params,"_PAGEWARN")) {/* the slot from DATABASE should be available */ RenameField(Params,"","_PAGEWARN"); /*SetFieldValue(Params,"_PAGEWARN","0"); */ } if (multipage) { if (!stricmp(action,"SUBMIT")) /* final submission of a multi-page form. */ { ValidatePage(argv0,htmlout,dbname,config,Params,page); if (*GetFieldValue(Params,"_PAGEWARN")) allowsave = 0; if (allowsave) SetFieldValue(Params,"_FORMDONE","1"); } /* else don't validate: save & quit can never fail */ if (allowsave) ValidatePage(argv0,htmlout,dbname,config,Params,"SUBMIT"); } else { ValidatePage(argv0,htmlout,dbname,config,Params,"SUBMIT"); if (*GetFieldValue(Params,"_PAGEWARN")) allowsave = 0; if (allowsave) SetFieldValue(Params,"_FORMDONE","1"); } /*if multipage */ if (allowsave == 0) /* show the page again */ { /* SetFieldValue(Params,"_PAGEWARN","1"); */ SendCGIHeader(htmlout,NULL); ret = multipage ? ShowFormPage(argv0,htmlout,dbname,Params,GetFieldValue(Params,"_PAGEBACK"),page) : ShowForm(argv0,htmlout,dbname,Params); } else { /* SUBMIT validation doesn't do error checking, so we can always run it. A SAVE action must always succeed, so we don't do validation for it */ ret = SaveData(argv0,dbname, Params, config, (atoi(GetFieldValue(config,"SAVEPAGE")) && hasSession) || (hasuid && needslogin)); PrintFinish(argv0,htmlout,dbname,config,Params,ret); } /* if allowsave == 0 */ } } /* range of allowsave */ } /* SAVE */ } /* if ret */ if (ret) /* something went wrong? */ { if (ErrorMessage) { if (strnicmp(ErrorMessage,"http://",7) == 0) { char * temp = (char*)CGIMALLOC(strlen(ErrorMessage) + 16); sprintf(temp,"Location: %s\n\n",ErrorMessage); SendCGIHeader(htmlout,temp); CGIFREE(temp); } else { SendCGIHeader(htmlout,NULL); HTMLWrite(htmlout,ErrorMessage); } } else { SendCGIHeader(htmlout,NULL); HTMLWrite(htmlout,"<P>CGI error: unknown action<pre>"); HTMLWrite(htmlout,"database: '"); HTMLWrite(htmlout,dbname); HTMLWrite(htmlout,"'\npassword: '"); HTMLWrite(htmlout,password); HTMLWrite(htmlout,"'\naction: '"); HTMLWrite(htmlout,action); HTMLWrite(htmlout,"'\npage: '"); HTMLWrite(htmlout,page); HTMLWrite(htmlout,"'\nsession: '"); HTMLWrite(htmlout,session); HTMLWrite(htmlout,"'\nAll parameters: \n"); DebugShowNVP(htmlout,Params); } } if (ret > 100) { char * msg; char* email = GetFieldValue(config,"ADMINEMAIL"); if (*email) { char temp[32]; TextBuffer* m = NewBuffer(1024); sprintf(temp,"%d",ret); BufferWrite(m,"Database: "); BufferWrite(m,dbname); BufferWrite(m,"\r\nError code: "); BufferWrite(m,temp); BufferWrite(m,"\r\nRemote host: "); BufferWrite(m,GetFieldValue(config,"HOST")); BufferWrite(m,"\r\nPage file: "); BufferWrite(m,page); BufferWrite(m,"\r\nAction: "); BufferWrite(m,action); BufferWrite(m,"\r\n_PAGE: "); BufferWrite(m,GetFieldValue(config,"_PAGE")); BufferWrite(m,"\r\n_PAGEBACK: "); BufferWrite(m,GetFieldValue(config,"_PAGEBACK")); BufferWrite(m,"\r\n_PAGENEXT: "); BufferWrite(m,GetFieldValue(config,"_PAGENEXT")); BufferWrite(m,"\r\n_PASSWORD: "); BufferWrite(m,password); BufferWrite(m,"\r\n"); msg = CopyBuffer(m); SendMail(email, "Web access security violation", msg, GetSetting(config,"EMAILSERVER",""), GetSetting(config,"EMAILPROFILE","Windows Messaging Settings"), GetSetting(config,"EMAILNAME",""), GetSetting(config,"EMAILPWD","")); CGIFREE(msg); DeleteBuffer(m); } ShowProgramStatus(htmlout,Security); } DeleteNVP(config); if (dbname) CGIFREE(dbname); if (password) CGIFREE(password); if (action) CGIFREE(action); if (page) CGIFREE(page); return ret; }

int CheckFileName (  char *  Name, char *  AllowedEndings )

Definition at line 223 of file ezs.c. References HasToken(). Referenced by ShowForm(). { char * c = strrchr(Name,'.'); if (!c) return 0; return HasToken(AllowedEndings,c+1,0); }

int DeleteOldRecords (  FILE *  database, CGINameValue *  header, CGINameValue *  Params )

Definition at line 230 of file ezs.c. References DatabaseFindFast(), GetFieldValue, CGINameValue::name, and CGINameValue::value. { CGINameValue Userid[2]; int previous = 0; Userid[0].name="_SESSION"; Userid[0].value=GetFieldValue(Params,"_SESSION"); Userid[1].name=0; if (Userid[0].value[0] == 0) return 0; /* don't look for empties */ while(1) { int current; if (DatabaseFindFast(database, header,Userid,&current)==0) break; if (previous) { int ptr = ftell(database); if (fseek(database,previous,SEEK_SET) == 0) { fwrite("#",1,1,database); if (fseek(database,ptr,SEEK_SET) != 0) return 1; } if (ptr == -1) break; } previous = current; } return 0; /* success */ }

int FindUserRecordASC (  char *  idfields, FILE *  database, CGINameValue *  header, CGINameValue *  Params )

Searches for the last row in a tab-delimited ascii file matching the 'Params' query. Returns 0 on failure or if the Params are null. Definition at line 266 of file ezs.c. References CopyList(), DatabaseFindFast(), DeleteNVP(), GetField(), GetFieldValue, CGINameValue::name, NULL, ReadPairedString(), strdup(), and CGINameValue::value. Referenced by LoadUserDataASC(). { CGINameValue * Userid; CGINameValue * Current = NULL; int i; int ret = 0; Userid = ReadPairedString(idfields,',',0); for (i=0; Userid[i].name; i++) { Userid[i].value = strdup(GetFieldValue(Params,Userid[i].name)); if (Userid[i].value[0]) ret = 1; } if (ret) { ret = 0; while(1) { if (DatabaseFindFast(database, header,Userid,NULL)==0) break; ret = 1; DeleteNVP(Current); Current = CopyList(header,0); /* store a copy of the last record we've found */ } if (Current != NULL) { CGINameValue* x; char*c; for(i=0; header[i].name; i++) {/* swap the pointers to avoid allocating memory */ if (!header[i].name[0]) continue; x = GetField(Current,header[i].name); if (!x) continue; c = x->value; x->value = header[i].value; header[i].value = c; } } } DeleteNVP(Current); DeleteNVP(Userid); return ret; }

void GenerateSessionID (  char *  session, unsigned int  i )

We can track version numbers with the session id. Z**G** EZSurvey 2000 (ODBC early release) Z**H** EZSurvey 2001 g**g** EZSurvey 2002 x****Z** EZSurvey 2003 x****Y** EZSurvey 2004 X****Y** EZSurvey 2007 Definition at line 112 of file ezs.c. References itos(). Referenced by GenerateUniqueID(). { #ifdef XP_WIN SYSTEMTIME tb; unsigned int a,b,c; GetSystemTime(&tb); a = (tb.wMonth - 1); a = a << 4; a |= (tb.wDay - 1); a = a << 5; a |= (tb.wHour); a = a << 5; a |= (tb.wMinute); a = a << 6; a |= (tb.wSecond); b = (i & 0xAA55AA55)|(a&0x55AA55AA); c = (i & 0x55AA55AA)|(a&0xAA55AA55); *session = 'X'; session = itos(tb.wYear-2000,session+1); session = itos(b,session); *session = 'Y'; session++; session = itos(c,session); #else time_t timer; struct tm *tb; unsigned int a,b,c; time(&timer); tb = gmtime(&timer); a = (tb->tm_mon); a = a << 4; a |= (tb->tm_mday - 1); a = a << 5; a |= (tb->tm_hour); a = a << 5; a |= (tb->tm_min); a = a << 6; a |= (tb->tm_sec); b = ((i) & 0xAA55AA55)|(a&0x55AA55AA); c = ((i) & 0x55AA55AA)|(a&0xAA55AA55); *session = 'x'; session = itos(tb->tm_year-100,session+1); session = itos(b,session); *session = 'Z'; session++; session = itos(c,session); #endif }

void GenerateUniqueID (  char *  newsession, char *  hash )

Definition at line 158 of file ezs.c. References CGIFCLOSE, CGIFOPEN, and GenerateSessionID(). Referenced by CGImain(), and JSUniqueId(). { unsigned int j, i = 0; #ifdef XP_WIN HKEY key; #ifdef UNICODE HANDLE Mutex = CreateMutex(0,FALSE,L"EZS.CGI.RANDOM"); #else HANDLE Mutex = CreateMutex(0,FALSE,"EZS.CGI.RANDOM"); #endif WaitForSingleObject(Mutex,20000); #ifdef UNICODE if (RegOpenKeyEx(HKEY_CURRENT_USER,L"SOFTWARE\\Raosoft\\EZSurvey",0,0,&key) == ERROR_SUCCESS) { DWORD type,length = sizeof(i); RegQueryValueEx(key,L"RANDOM",0,&type,(unsigned char*)&i,&length); RegCloseKey(key); } #else if (RegOpenKeyEx(HKEY_CURRENT_USER,"SOFTWARE\\Raosoft\\EZSurvey",0,KEY_ALL_ACCESS,&key) == ERROR_SUCCESS) { DWORD type,length = sizeof(i); RegQueryValueEx(key,"RANDOM",0,&type,(unsigned char*)&i,&length); RegCloseKey(key); } #endif #else FILE* f = CGIFOPEN("random.seed","rb"); if (f) { fread(&i,sizeof(i),1,f); CGIFCLOSE(f);} #endif j = i >> 16; if (hash) while (*hash) j += *hash++; #ifdef XP_WIN j += GetTickCount(); #else #endif #ifndef __WINCE__ i += getpid(); #endif i = (j << 16) | (i & 0x0000ffff); GenerateSessionID(newsession,i); #ifdef XP_WIN #ifdef UNICODE if (RegOpenKeyEx(HKEY_CURRENT_USER,L"SOFTWARE\\Raosoft\\EZSurvey",0,0,&key) == ERROR_SUCCESS) { RegSetValueEx(key,L"RANDOM",0,REG_DWORD,(unsigned char*)&i,sizeof(i)); RegCloseKey(key); } #else if (RegOpenKeyEx(HKEY_CURRENT_USER,"SOFTWARE\\Raosoft\\EZSurvey",0,KEY_ALL_ACCESS,&key) == ERROR_SUCCESS) { RegSetValueEx(key,"RANDOM",0,REG_DWORD,(unsigned char*)&i,sizeof(i)); RegCloseKey(key); } #endif ReleaseMutex(Mutex); CloseHandle(Mutex); #else f = CGIFOPEN("random.seed","wb"); if (f) { fwrite(&i,sizeof(i),1,f); CGIFCLOSE(f);} #endif }

int GetRespcount (  char *  argv0, char *  dbname )

Definition at line 1244 of file ezs.c. References CGIFOPEN, ExpandLocalPath(), and MAXPATH. { char filename[MAXPATH]; int i = 0; FILE * f; ExpandLocalPath(argv0,filename,dbname,".respcount"); f = CGIFOPEN(filename,"rb"); if (f) { fread(&i,sizeof(i),1,f); fclose(f); } return i; }

char* itos (  unsigned int  value, char *  p )

Definition at line 87 of file ezs.c. Referenced by GenerateSessionID(). { int i,j; char c; j=0; for (i=0;value && i<34;i++) { c = (char)(value % 32); p[j++]= (c < 10) ? c + '0' : c + 'a' - 10; value = value / 32; } p[j]=0; return p+j; }

static char* JSRankIndex (  ScriptEnvironment *  Env, char *  cmd, int  argc, char **  argv, CGINameValue *  Params )  [static]

in: "3,4,2,1" , "2" out: "3" Definition at line 609 of file ezs.c. References HasToken(), NULL, and strdup(). Referenced by ODBCRunScript(), and ValidatePage(). { if (argc > 1 ) { char temp[64]; int i=0; if (HasToken(argv[0], argv[1],&i)) { sprintf(temp,"%d",i); return strdup(temp); } } return NULL; }

static char* JSRankSort (  ScriptEnvironment *  Env, char *  cmd, int  argc, char **  argv, CGINameValue *  Params )  [static]

in: code1=rank1,code2=rank2,code3=rank3 out: code2,code3,code1 Definition at line 570 of file ezs.c. References CGIMALLOC, NULL, ReadPairedString(), ReadPairedValues(), and SortNVP(). Referenced by ODBCRunScript(), and ValidatePage(). { CGINameValue* list; int i; int length; char* ret; if (argc == 0) return NULL; if (argc == 1) list = ReadPairedString(argv[0],',',0); else list = ReadPairedValues(argc,argv,0); SortNVP(list); length = 0; for (i=0; list[i].name; i++) { length += strlen(list[i].name); length ++; } if (!length) return NULL; ret = CGIMALLOC(1+length); length = 0; for (i=0; list[i].name; i++) { if (!list[i].value) continue; if (!list[i].value[0]) continue; strcpy(ret+length,list[i].name); length += strlen(list[i].name); strcpy(ret+length,","); length ++; } if (length) ret[length-1] = 0; else ret[0]=0; return ret; }

static char* JSSendMail (  ScriptEnvironment *  Env, char *  cmd, int  argc, char **  argv, CGINameValue *  Params )  [static]

recipient, subject, message Definition at line 534 of file ezs.c. References ScriptEnvironment::config, GetSetting(), and SendMail(). { if (!Env->config) return 0; if (argc < 3) return 0; { char* server = GetSetting(Env->config,"EMAILSERVER",""); char* profile = GetSetting(Env->config,"EMAILPROFILE","Windows Messaging Settings"); char* name = GetSetting(Env->config,"EMAILNAME",""); char* password = GetSetting(Env->config,"EMAILPWD",""); SendMail(argv[0],argv[1],argv[2], server, profile, name, password); } return 0; }

static char* JSShowPage (  ScriptEnvironment *  Env, char *  cmd, int  argc, char **  argv, CGINameValue *  Params )  [static]

Definition at line 493 of file ezs.c. References CGIFREE, GetFieldValue, HasToken(), SetFieldValue(), and strdup3(). Referenced by ValidateBack(), and ValidatePage(). {/* prepend the next page to the _PAGENEXT list */ char* pageskip; if (argc < 1) return 0; pageskip = GetFieldValue(Params,"_PAGESKIP"); if (*pageskip) { if (!HasToken(pageskip,argv[0],0)) { char*x = strdup3(pageskip,",",argv[0]); SetFieldValue(Params,"_PAGESKIP",x); CGIFREE(x); } } else { SetFieldValue(Params,"_PAGESKIP",argv[0]); } return 0; }

static char* JSSQLEscape (  ScriptEnvironment *  Env, char *  cmd, int  argc, char **  argv, CGINameValue *  Params )  [static]

in: I am 4' out: I am 4'' tall Definition at line 628 of file ezs.c. References CGIMALLOC, and NULL. { size_t i=0,j=0; char *in; char *out; char *extra = NULL;; if (argc == 0) return NULL; in = argv[0]; out = CGIMALLOC(1 + (strlen(in) * 2)); if (argc > 1) extra = argv[1]; while (in[i]) { if (in[i] == '\'') { out[j++] = '\''; out[j++] = '\''; } else if (strchr("\t\r\n",in[i])) { out[j++] = ' '; } else if (extra && strchr(extra,in[i])) { out[j++] = '\\'; out[j++] = in[i]; } else out[j++] = in[i]; i++; } out[j]=0; return out; }

static char* JSTimeDate (  ScriptEnvironment *  Env, char *  cmd, int  argc, char **  argv, CGINameValue *  Params )  [static]

Definition at line 521 of file ezs.c. References GetTime(), and strdup(). Referenced by ODBCRunScript(), ValidateBack(), and ValidatePage(). { char datetime[16]; GetTime(datetime,0,0); return strdup(datetime); }

static char* JSTimeTime (  ScriptEnvironment *  Env, char *  cmd, int  argc, char **  argv, CGINameValue *  Params )  [static]

Definition at line 527 of file ezs.c. References GetTime(), and strdup(). Referenced by ODBCRunScript(), ValidateBack(), and ValidatePage(). { char datetime[16]; GetTime(0,datetime,0); return strdup(datetime); }

static char* JSUniqueId (  ScriptEnvironment *  Env, char *  cmd, int  argc, char **  argv, CGINameValue *  Params )  [static]

Definition at line 514 of file ezs.c. References GenerateUniqueID(), and strdup(). Referenced by ODBCRunScript(), ValidateBack(), and ValidatePage(). { char datetime[32]; GenerateUniqueID(datetime,argc?argv[0]:0); return strdup(datetime); }

CGINameValue* LoadUserData (  CGINameValue *  config, char *  argv0, char *  dbname, CGINameValue *  Params, int *  err )

Definition at line 469 of file ezs.c. References GetSetting(), LoadUserDataASC(), LoadUserDataSQL(), and strnicmp(). Referenced by CGImain(), and SaveData(). { char* order = GetSetting(config,"LOGINSEQUENCE","ASC"); CGINameValue* x = 0; while (*order && !x) { if (strchr(" ;,",*order)) order++; else if (!strnicmp(order,"ASC",3)) { x = LoadUserDataASC(config,argv0,dbname,Params,err); order += 3; } #ifdef CGI_ODBC else if (!strnicmp(order,"ODBC",4)) { x = LoadUserDataSQL(config,argv0,dbname,Params,err); order += 4; } #endif } return x; }

CGINameValue* LoadUserDataASC (  CGINameValue *  config, char *  argv0, char *  dbname, CGINameValue *  Params, int *  err )

Definition at line 320 of file ezs.c. References DatabaseClose(), DatabaseOpen(), DatabaseReadRecord(), ExpandLocalPath(), FindUserRecordASC(), GetField(), GetFieldValue, GetSetting(), MAXPATH, NULL, NULLSTR, stricmp(), and CGINameValue::value. Referenced by LoadUserData(). { FILE * db; CGINameValue * header; char dbfile[MAXPATH]; int ret = 0; char *c = GetSetting(config,"SAVEDATANAME",NULLSTR); char *index = GetSetting(config,"SAVEINDEXNAME",NULLSTR); char *idfields = GetSetting(config,"IDFIELDS","IFMUID,IFMUID1,IFMUID2,IFMUID3,IFMUID4"); if (!*idfields) idfields = "_SESSION"; if (*c) { if (strlen(c) > 1000) c[1000]=0; ExpandLocalPath(argv0,dbfile,c,NULLSTR); } else { ExpandLocalPath(argv0,dbfile,dbname,".asc"); } if (!DatabaseOpen(dbfile,&db,&header,0,0)) { if (err) *err = 2; return NULL; } if (*index) { FILE * indexdb; CGINameValue * indexheader; char indexfile[MAXPATH]; int pos; if (strlen(index) > 1000) index[1000]=0; ExpandLocalPath(argv0,indexfile,index,NULLSTR); if (DatabaseOpen(indexfile,&indexdb,&indexheader,0,0)) { if (FindUserRecordASC(idfields,indexdb,indexheader,Params)) { pos = atoi(GetFieldValue(indexheader,"_POS")); if (pos > 0) if (fseek(db,pos,0) == 0) ret = DatabaseReadRecord(db,header,0); /* ret = 1 if a record was found successfully */ if (ret) /* did we get the right field? */ { int i; CGINameValue* c ; for (i=0; ret && indexheader[i].name; i++) { if (!stricmp(indexheader[i].name,"_POS")) continue; c = GetField(header,indexheader[i].name); if (c) if (strcmp(indexheader[i].value,c->value)) ret = 0; } } } DatabaseClose(indexdb,indexheader); } } if (!ret) ret = FindUserRecordASC(idfields,db,header,Params); if (ret) { DatabaseClose(db,NULL); return header; } else { DatabaseClose(db,header); return 0; } }

CGINameValue* LoadUserDataSQL (  CGINameValue *  config, char *  argv0, char *  dbname, CGINameValue *  Params, int *  err )

Definition at line 399 of file ezs.c. References CGIFREE, CopyBuffer(), CopyListDeep(), DeleteBuffer(), DeleteNVP(), GetSetting(), LogError(), NewBuffer(), ODBCConnect(), ODBCDisconnect(), ODBCQuery(), and ODBCRunScript(). Referenced by LoadUserData(). { SQLDB* db = 0; CGINameValue* x = 0; EZSSTREAM result; char *c; int ret; /* First, try to UPDATE the database. If that doesn't work, try UPDATE */ db = ODBCConnect( GetSetting(config,"ODBCSERVICE",""), GetSetting(config,"ODBCNAME",""), GetSetting(config,"ODBCPASSWORD",""),0); if (!db) { LogError("\nODBCOpen() failed"); if (err) *err = 52; return 0; } /* Try a SELECT statement. */ memset(&result,0,sizeof(result)); result.t = NewBuffer(1024); /* select * from table where IFMUID1={IFMUID1} */ ret = ODBCRunScript(argv0,&result,dbname,config,Params,"<SCRIPT NAME=\"LOADODBC\""); c = CopyBuffer(result.t); DeleteBuffer(result.t); if (ret && *c) { char s[128]; sprintf(s,"\nODBCRunScript error %d for LOADODBC ",ret); LogError(s); } if (!ret) { x = ODBCQuery(db,c,0); if (x) {/*If it succeeds, we need to run ODBCREAD */ EZSSTREAM result; CGINameValue* y; memset(&result,0,sizeof(result)); result.t = NewBuffer(1024); ret = ODBCRunScript(argv0,&result,dbname,config,x,"<SCRIPT NAME=\"READODBC\""); CGIFREE(c); c = CopyBuffer(result.t); DeleteBuffer(result.t); if (ret && *c) { char s[128]; sprintf(s,"\nODBCRunScript error %d for READODBC ",ret); LogError(s); } y = CopyListDeep(x,0); DeleteNVP(x); x=y; } } if (ret && *c) { LogError(c); } CGIFREE(c); ODBCDisconnect(db); return x; }

int Login (  EZSSTREAM *  htmlout, int  Security, char *  dbname, CGINameValue *  Params, char *  argv0, CGINameValue *  config )

Definition at line 1917 of file ezs.c. References CGI_ALLOW_APPEND, DatabaseClose(), DatabaseOpen(), ExpandLocalPath(), GetField(), GetFieldValue, GetSetting(), HasTokenI(), HTMLEscape(), HTMLPrintf(), HTMLWrite(), MAXPATH, NULL, NULLSTR, and ReadPairedString(). { FILE * db = NULL; CGINameValue * header = NULL; char dbfile[MAXPATH]; int i; char *c = GetSetting(config,"SAVEDATANAME",NULLSTR); if (*c) { if (strlen(c) > 1000) c[1000]=0; ExpandLocalPath(argv0,dbfile,c,NULLSTR); } else { ExpandLocalPath(argv0,dbfile,dbname,".asc"); } if (HasTokenI(GetSetting(config,"LOGINSEQUENCE","ASC"),"ASC",0) && !DatabaseOpen(dbfile,&db,&header,0,0)) { HTMLWrite(htmlout,"<head><title>Setup error</title></head>\n\n<BODY>\n"); HTMLWrite(htmlout,"Sorry, I can't access the data file. Check the read/write permissions."); return 0; } HTMLWrite(htmlout,"<head><title>Login</title></head>\n\n<BODY>\n"); if (Security & CGI_ALLOW_APPEND) { HTMLWrite(htmlout,"<H3>Start</H3>"); #ifdef __WINCE__ HTMLWrite(htmlout,"<FORM ACTION=\"/ezs\" METHOD=\"POST\" ACCEPT-CHARSET=\"UTF-8\">\n"); #else HTMLWrite(htmlout,"<FORM METHOD=\"POST\" ACCEPT-CHARSET=\"UTF-8\">\n"); #endif HTMLWrite(htmlout,"<INPUT TYPE=\"HIDDEN\" NAME=\"_ACTION\" VALUE=\"START\" />\n"); HTMLWrite(htmlout,"<INPUT TYPE=\"HIDDEN\" NAME=\"DATABASE\" VALUE=\""); HTMLEscape(htmlout,dbname); HTMLWrite(htmlout,"\" />\n"); HTMLWrite(htmlout,"<INPUT TYPE=\"SUBMIT\" VALUE=\" Start Survey \" /></FORM>"); } HTMLWrite(htmlout,"<H3>Please enter your login and password</H3>"); #ifdef __WINCE__ HTMLWrite(htmlout,"<FORM ACTION=\"/ezs\" METHOD=\"POST\" ACCEPT-CHARSET=\"UTF-8\">\n"); #else HTMLWrite(htmlout,"<FORM METHOD=\"POST\" ACCEPT-CHARSET=\"UTF-8\">\n"); #endif HTMLWrite(htmlout,"<INPUT TYPE=\"HIDDEN\" NAME=\"_ACTION\" VALUE=\"START\" />\n"); HTMLWrite(htmlout,"<INPUT TYPE=\"HIDDEN\" NAME=\"DATABASE\" VALUE=\""); HTMLEscape(htmlout,dbname); HTMLWrite(htmlout,"\" />\n<tt>"); { char* idfields = GetSetting(config,"IDFIELDS","IFMUID,IFMUID1,IFMUID2,IFMUID3,IFMUID4"); CGINameValue *f = ReadPairedString(idfields,',',0); if (f) { HTMLWrite(htmlout,"<label for=\"N\">Login:</label>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</tt>"); HTMLWrite(htmlout,"<INPUT ID=\"N\" NAME=\""); HTMLEscape(htmlout,f[0].name); HTMLWrite(htmlout,"\" VALUE=\""); HTMLEscape(htmlout,GetFieldValue(Params,f[0].name)); HTMLWrite(htmlout,"\" />\n<br>"); } for (i=1; f[i].name; i++) { if (header && !GetField(header,f[i].name)) continue; if (i == 1) { HTMLWrite(htmlout,"<tt><label for=\"P\">Password:</label>&nbsp;"); HTMLWrite(htmlout,"</tt><INPUT ID=\"P\" TYPE=\"PASSWORD\" NAME=\""); } else { HTMLPrintf(htmlout,"<tt><label for=\"P%d\">Password%d:</label>&nbsp;",i,i); HTMLPrintf(htmlout,"</tt><INPUT ID=\"P%d\" TYPE=\"PASSWORD\" NAME=\"",i); } HTMLEscape(htmlout,f[i].name); HTMLWrite(htmlout,"\" VALUE=\""); HTMLEscape(htmlout,GetFieldValue(Params,f[i].name)); HTMLWrite(htmlout,"\" />\n<br>"); } } HTMLWrite(htmlout,"<INPUT TYPE=\"SUBMIT\" VALUE=\" Login to the survey \" /></FORM></BODY>"); DatabaseClose(db,header); return 0; }

int ODBCRunScript (  char *  argv0, EZSSTREAM *  result, char *  dbname, CGINameValue *  config, CGINameValue *  Params, char *  search )

search = <script name=SAVEODBC Definition at line 1138 of file ezs.c. References CGIFCLOSE, FileOpen(), JSEval(), JSGetEnv(), JSIndexOf(), JSPrint(), JSRandom(), JSRankIndex(), JSRankSort(), JSReport(), JSSQLEscape(), JSstrlen(), JSsubstr(), JSTimeDate(), JSTimeStamp(), JSTimeTime(), JStoFixed(), JSToNumber(), JSUniqueId(), NULL, PrintScriptError(), ReadUntilChar(), ReadUntilWordS(), and RunScript(). Referenced by LoadUserDataSQL(), and TryODBC(). { int ret; FILE* script; ScriptFunction Functions[] = {{"escape",2,(ScriptFunctionCall)*JSSQLEscape}, {"print",16,(ScriptFunctionCall)*JSPrint}, {"write",16,(ScriptFunctionCall)*JSPrint}, {"eval",1,(ScriptFunctionCall)*JSEval}, {"timestamp",0,(ScriptFunctionCall)*JSTimeStamp}, {"timedate",0,(ScriptFunctionCall)*JSTimeDate}, {"timetime",0,(ScriptFunctionCall)*JSTimeTime}, {"uniqueid",1,(ScriptFunctionCall)*JSUniqueId}, {"toFixed",2,(ScriptFunctionCall)*JStoFixed}, {"ranksort",128,(ScriptFunctionCall)*JSRankSort}, {"rankindex",2,(ScriptFunctionCall)*JSRankIndex}, {"runReport",8,(ScriptFunctionCall)*JSReport}, {"environment",1,(ScriptFunctionCall)*JSGetEnv}, {"number",1,(ScriptFunctionCall)*JSToNumber}, {"toNumber",1,(ScriptFunctionCall)*JSToNumber}, {"random",1,(ScriptFunctionCall)*JSRandom}, {"subStr",3,(ScriptFunctionCall)*JSsubstr}, {"indexOf",4,(ScriptFunctionCall)*JSIndexOf}, {"length",1,(ScriptFunctionCall)*JSstrlen}, {0,0,0}}; ScriptEnvironment Global; memset(&Global,0,sizeof(Global)); Global.htmlout = result; Global.Functions = Functions; Global.argv0 = argv0; Global.config = config; script = FileOpen(argv0,dbname,".val"); if (script == NULL) return 1; /* OK */ if (!ReadUntilWordS(script,0,search)) { ret = 57; goto end; } ReadUntilChar(script,0,0,">",0); ret = RunScript(&Global,script,Params); /* stops at </SCRIPT> */ if (ret > 0) { PrintScriptError(result,&Global, script, ret); } end: CGIFCLOSE(script); return ret; }

int PrintFinish (  char *  argv0, EZSSTREAM *  htmlout, char *  dbname, CGINameValue *  config, CGINameValue *  Params, int  ret )

Definition at line 1658 of file ezs.c. References CGIFCLOSE, CGIFREE, CGIMALLOC, DebugShowNVP(), FileOpen(), GetEnvironment(), GetSetting(), HTMLPrintf(), HTMLWrite(), LogError(), LogMessage(), NULL, NULLSTR, RunReport(), and SendCGIHeader(). Referenced by CGImain(). { if (ret) { /* if there are any data errors, we want to deal with them now. */ SendCGIHeader(htmlout,NULL); switch (ret) { case 2 : HTMLWrite(htmlout,"<P>Unable to read from the data file. "); #ifdef XP_WIN HTMLWrite(htmlout,"You probably need to configure your server to allow writing to "); HTMLWrite(htmlout,GetSetting(config,"SAVEDATANAME",dbname)); #else HTMLWrite(htmlout,"You probably need to log into the server and run <tt>chmod a+w "); HTMLWrite(htmlout,GetSetting(config,"SAVEDATANAME",dbname)); HTMLWrite(htmlout,"</tt>"); #endif break; case 6 : HTMLWrite(htmlout,"<P>Unable to write to the data file. "); #ifdef XP_WIN HTMLWrite(htmlout,"You probably need to configure your server to allow writing to "); HTMLWrite(htmlout,GetSetting(config,"SAVEDATANAME",dbname)); #else HTMLWrite(htmlout,"You probably need to log into the server and run <tt>chmod a+w "); HTMLWrite(htmlout,GetSetting(config,"SAVEDATANAME",dbname)); HTMLWrite(htmlout,"</tt>"); #endif break; case 9 : HTMLWrite(htmlout,"<P>Unable to write to the index file. "); #ifdef XP_WIN HTMLWrite(htmlout,"You probably need to configure your server to allow writing to "); HTMLWrite(htmlout,GetSetting(config,"SAVEINDEXNAME",dbname)); #else HTMLWrite(htmlout,"You probably need to log into the server and run <tt>chmod a+w "); HTMLWrite(htmlout,GetSetting(config,"SAVEINDEXNAME",dbname)); HTMLWrite(htmlout,"</tt>"); #endif break; case 8 : HTMLWrite(htmlout,"<P>Unable to write to the data file. "); #ifdef XP_WIN HTMLWrite(htmlout,"You probably need to configure your server to allow writing to "); HTMLWrite(htmlout,GetSetting(config,"SAVEXMLNAME",dbname)); #else HTMLWrite(htmlout,"You probably need to log into the server and run <tt>chmod a+w "); HTMLWrite(htmlout,GetSetting(config,"SAVEXMLNAME",dbname)); HTMLWrite(htmlout,"</tt>"); #endif break; case 4 : HTMLWrite(htmlout,"<P>A data file did not exist, and a new file could not be created. "); HTMLWrite(htmlout,"Please check the file acces permissions for "); HTMLWrite(htmlout,GetSetting(config,"SAVEDATANAME",dbname)); break; case 5 : HTMLWrite(htmlout,"<P>The database file does not match this form. " "Please download the current data and then republish the web site. "); LogMessage("\nezs: data file does not match the form: "); LogMessage(GetSetting(config,"SAVEDATANAME",dbname)); HTMLWrite(htmlout,GetSetting(config,"SAVEDATANAME",dbname)); HTMLWrite(htmlout,"<P>Data dump:<PRE>\n"); DebugShowNVP(htmlout,Params); HTMLWrite(htmlout,"</PRE>\n"); break; case 23: HTMLWrite(htmlout,"<P>The server ran out of time waiting for a file lock."); HTMLWrite(htmlout,"<P>Data dump:<PRE>\n"); DebugShowNVP(htmlout,Params); HTMLWrite(htmlout,"</PRE>\n"); break; #ifdef XP_WIN case 31: HTMLWrite(htmlout,"<P>The mapi32.dll library is not available."); break; case 32: HTMLWrite(htmlout,"<P>The mapi32.dll library does not support the CMC protocol."); break; case 33: HTMLWrite(htmlout,"<P>The destination email address was invalid."); break; case 34: HTMLWrite(htmlout,"<P>The email server refused to accept your message."); break; #else case 36: HTMLWrite(htmlout,"<P>The sendmail program could not be found. "); break; #endif case 52: HTMLWrite(htmlout,"<P>A connection could not be made to the database. See logerr.txt for details."); LogError("Service: "); LogError(GetSetting(config,"ODBCSERVICE","(undefined)")); LogError("Login: "); LogError(GetSetting(config,"ODBCNAME","(undefined)")); break; #ifdef XP_WIN case 61: HTMLWrite(htmlout,"<P>Winsock 2.0 is not available."); break; #endif case 62: HTMLWrite(htmlout,"<P>The server could not be found. Server:"); HTMLWrite(htmlout,GetSetting(config,"EMAILSERVER","")); break; case 63: HTMLWrite(htmlout,"<P>An outgoing network connection could not be opened."); break; case 64: HTMLWrite(htmlout,"<P>Could not connect to the outgoing server."); break; case 66: HTMLWrite(htmlout,"<P>The SOAP transaction failed because the function name is missing."); break; case 68: HTMLWrite(htmlout,"<P>The SOAP connection to "); HTMLWrite(htmlout,GetSetting(config,"SOAPHOST","127.0.0.1")); HTMLWrite(htmlout,":"); HTMLWrite(htmlout,GetSetting(config,"SOAPPORT","80")); HTMLWrite(htmlout,"/"); HTMLWrite(htmlout,"failed."); break; default: HTMLPrintf(htmlout,"<P>Error %d occurred. See logerr.txt for details. Data were not saved.",ret); } /* switch (ret) */ HTMLWrite(htmlout,"<hr>"); } else /* ret */ { if (atoi(GetSetting(config,"SHOWREDIRECT","0")) && *GetSetting(config,"REDIRECT","")) { char * c = GetSetting(config,"REDIRECT",""); char * temp; if (c[0] == '/') { #ifndef VPWSCGI char * hostRoot = GetEnvironment(htmlout,"HTTP_HOST"); if (!hostRoot) hostRoot = ""; #endif temp= (char*)CGIMALLOC(strlen(c) + strlen(hostRoot) + 32); sprintf(temp,"Location: http://%s%s\r\n\r\n",hostRoot,c); } else { temp = (char*)CGIMALLOC(strlen(c) + 16); sprintf(temp,"Location: %s\r\n\r\n",c); } SendCGIHeader(htmlout,temp); CGIFREE(temp); } else { int isform = 0; SendCGIHeader(htmlout,NULL); HTMLWrite(htmlout,"<html>"); HTMLWrite(htmlout,"<head><title>"); HTMLWrite(htmlout,GetSetting(config,"MESSAGE","")); HTMLWrite(htmlout,"</title></head><body>"); if (atoi(GetSetting(config,"DISPLAYMESSAGE","1")) ) { /* Display the message */ HTMLWrite(htmlout,GetSetting(config,"MESSAGE","<P>Thank you!")); } if (atoi(GetSetting(config,"DISPLAYFORM","0"))) isform = 1; if (isform || atoi(GetSetting(config,"DISPLAYREPORT","0"))) { char *c = GetSetting(config,isform ? "FORM" : "REPORT",NULLSTR); /* use the filename from the config file, but in the current directory */ FILE *f = FileOpen(argv0,c,""); /* 4d. Display the report you set above */ if (f) { RunReport(argv0,htmlout,f,Params,NULL,NULL,isform,NULL); CGIFCLOSE(f); } } if (atoi(GetSetting(config,"DISPLAYHOTLINK","0"))) { /* 4e. Display the link you set above */ HTMLWrite(htmlout,"<HR><A HREF=\""); HTMLWrite(htmlout,GetSetting(config,"HOTLINK","/index.html")); HTMLWrite(htmlout,"\">Click here to continue</A>\n"); } HTMLWrite(htmlout,"</body></html>\n"); } /* redirect */ } /* ret */ return 0; }

int PrintInstructions (  EZSSTREAM *  htmlout  )

Definition at line 2007 of file ezs.c. References HTMLWrite(), RAOSOFT_CGI_COPYRIGHT, and RAOSOFT_CGI_VERSION. Referenced by CGImain(). { HTMLWrite(htmlout,"<head><title>EZSurvey CGI</title></head>\n"); #ifdef __WINCE__ /* IE caches POSTs if they look like GETs */ HTMLWrite(htmlout,"<FORM ACTION=/ezs METHOD=POST ACCEPT-CHARSET=\"UTF-8\">\n"); #else HTMLWrite(htmlout,"<FORM METHOD=GET ACCEPT-CHARSET=\"UTF-8\">\n"); #endif HTMLWrite(htmlout, "<H3>Start filling out a form</H3>" "<P><label for=D>Please type the name of the form:</label> <input ID=D name=DATABASE><BR>\n" "<input type=submit value=\" Click here to begin \"></FORM>"); HTMLWrite(htmlout, "<HR><P><A href=http://www.raosoft.com/products/ezsurvey>EZSurvey</A>&reg; " RAOSOFT_CGI_VERSION ". " RAOSOFT_CGI_COPYRIGHT ); return 0; }

int SaveData (  char *  argv0, char *  dbname, CGINameValue *  Params, CGINameValue *  config, int  SubtractOldStats )

Definition at line 1276 of file ezs.c. References CalcCountSummary(), CGIFCLOSE, CGIFOPEN, CGIFREE, CopyBuffer(), DeleteBuffer(), ExpandLocalPath(), FileOpen(), GetFieldValue, GetRespcount(), GetSetting(), HTMLWrite(), LoadUserData(), MAXPATH, CGINameValue::name, NewBuffer(), NULL, NULLSTR, ReadINIFileSection(), RenameField(), RunReport(), SendMail(), and swapchars(). Referenced by CGImain(). { int ret = 0; int respcount = GetRespcount(argv0,dbname); if ( atoi( GetSetting(config,"LOGDATETIME","1")) == 0) { RenameField(Params,"HOST","_HOST"); RenameField(Params,"DATE","_DATE"); RenameField(Params,"TIME","_TIME"); } if (atoi(GetSetting(config,"SAVEEMAIL","0"))) { char* form = GetSetting(config,"EMAILREPORT",""); char* address = GetSetting(config,"SAVEEMAILNAME",""); char* server = GetSetting(config,"EMAILSERVER",""); char* profile = GetSetting(config,"EMAILPROFILE","Windows Messaging Settings"); char* name = GetSetting(config,"EMAILNAME",""); char* password = GetSetting(config,"EMAILPWD",""); { EZSSTREAM result; char*c; FILE* script = NULL; memset(&result,0,sizeof(result)); result.t = NewBuffer(1024); if (*form) script = FileOpen(argv0,form,0); if (script) { RunReport(argv0,&result,script,Params,NULL,NULL,0,NULL); CGIFCLOSE(script);script=NULL; } else { int i; HTMLWrite(&result,"EZSurvey web data from: "); HTMLWrite(&result,GetFieldValue(Params,"HOST")); HTMLWrite(&result,"\r\nX-DATABASE: "); HTMLWrite(&result,dbname); HTMLWrite(&result,"\r\n"); for (i=0; Params[i].name; i++) { if (Params[i].name[0] == '_' || Params[i].name[0] == 0) continue; HTMLWrite(&result,Params[i].name); HTMLWrite(&result,": "); HTMLWrite(&result,Params[i].value); HTMLWrite(&result,"\r\n"); } } c = CopyBuffer(result.t); ret = SendMail(address,"EZSurvey form submission report",c, server, profile, name, password); CGIFREE(c); DeleteBuffer(result.t); } if (ret) return ret; } #if defined(XP_WIN) && !defined(__WINCE__) #define USE_MUTEX #endif if (atoi(GetSetting(config,"SAVESTAT","0"))) { char statfile[MAXPATH]; char *c = GetSetting(config,"SAVESTATNAME",NULLSTR); CGINameValue* count; CGINameValue* sum; CGINameValue* old; #ifdef USE_MUTEX HANDLE Mutex; char Mutex_name[MAXPATH+1]; strncpy(Mutex_name,statfile,MAXPATH); Mutex_name[MAXPATH] = 0; swapchars(Mutex_name, '\\', '/'); Mutex = CreateMutex(0,FALSE,statfile); if (Mutex) WaitForSingleObject(Mutex,20000); #else FILE* out; #endif old = NULL; if (SubtractOldStats) old = LoadUserData(config,argv0,dbname,Params,&ret); if (ret) return ret; ExpandLocalPath(argv0,statfile,c,NULLSTR); count = ReadINIFileSection(statfile, "COUNT",0); sum = ReadINIFileSection(statfile, "SUM",0); #ifndef USE_MUTEX out = CGIFOPEN(statfile,"wt"); if (out) /* can I open the file for writing? */ #endif { int i; if (count) { #ifndef USE_MUTEX fwrite("[COUNT]\n",1,8,out); #endif for(i=0; count[i].name; i++) {/* count */ int x = atoi(count[i].value); int d = CalcCountSummary(Params,count[i].name); if (old != NULL) d -= CalcCountSummary(old,count[i].name); x += d; #ifdef USE_MUTEX if (d) { char temp[32]; sprintf(temp,"%d",x); #ifdef UNICODE WritePrivateProfileStringA("COUNT",count[i].name,temp,statfile); #else WritePrivateProfileString("COUNT",count[i].name,temp,statfile); #endif } #else fprintf(out,"%s=%d\n",count[i].name,x); #endif } } if (sum) { #ifndef USE_MUTEX fwrite("[SUM]\n",1,6,out); #endif for(i=0; sum[i].name; i++) {/* count */ double x = strtod(sum[i].value,0); double d = strtod(GetFieldValue(Params,sum[i].name),0); if (x < 10E16 && x > -10E16 && d < 10E16 && d > -10E16) { if (old) d -= strtod(GetFieldValue(old,sum[i].name),0); if (d < 10E16 && d > -10E16) x += d; } #ifdef USE_MUTEX if (d != 0.0) { char temp[64]; sprintf(temp,"%f",x); #ifdef UNICODE WritePrivateProfileStringA("SUM",sum[i].name,temp,statfile); #else WritePrivateProfileString("SUM",sum[i].name,temp,statfile); #endif } #else fprintf(out,"%s=%f\n",sum[i].name,x); #endif } } #ifndef USE_MUTEX CGIFCLOSE(out); #endif } #ifdef USE_MUTEX if (Mutex) { ReleaseMutex(Mutex); CloseHandle(Mutex); } #endif if (old) DeleteNVP(old); DeleteNVP(count); DeleteNVP(sum); } /* save stats */ #undef USE_MUTEX if (atoi(GetSetting(config,"SAVEDATA","0"))) { char dbfile[MAXPATH]; char *c = GetSetting(config,"SAVEDATANAME",NULLSTR); char *index = GetSetting(config,"SAVEINDEXNAME",NULLSTR); int pos = 0; if (strlen(c) > 1000) c[1000]=0; if (strlen(index) > 1000) index[1000]=0; ExpandLocalPath(argv0,dbfile,c,NULLSTR); ret = SaveDataToASC(Params,dbfile,&pos); if (ret) { char s[128]; sprintf(s,"\nSaveDataToASC error %d for ",ret); LogError(dbfile); } else { FILE * db; CGINameValue * header; if (DatabaseOpen(dbfile,&db,&header,0,1)) { DeleteOldRecords(db,header,Params); DatabaseClose(db,header); } } if (pos && *index && ret == 0) { char indexfile[MAXPATH]; ExpandLocalPath(argv0,indexfile,index,NULLSTR); ret = DatabaseSaveIndex(indexfile,Params,pos); } if (ret) return ret; } if (atoi(GetSetting(config,"SAVEXML","0"))) { char dbfile[MAXPATH]; char *c = GetSetting(config,"SAVEXMLNAME",NULLSTR); if (strlen(c) > 1000) c[1000]=0; ExpandLocalPath(argv0,dbfile,c,NULLSTR); ret = SaveDataToXML(Params,dbfile,0); if (ret) { char s[128]; sprintf(s,"\nSaveDataToXML error %d for ",ret); LogError(dbfile); } if (ret) return ret; } #ifdef CGI_SOAP if (atoi(GetSetting(config,"SAVESOAP","0"))) { char* c; FILE* script; EZSSTREAM result; ScriptFunction Functions[] = {{"escape",1,(ScriptFunctionCall)*JSHTMLEscape}, {"print",16,(ScriptFunctionCall)*JSPrint}, {"write",16,(ScriptFunctionCall)*JSPrint}, {"eval",1,(ScriptFunctionCall)*JSEval}, {"toFixed",2,(ScriptFunctionCall)*JStoFixed}, {"ranksort",128,(ScriptFunctionCall)*JSRankSort}, {"runReport",8,(ScriptFunctionCall)*JSReport}, {"random",1,(ScriptFunctionCall)*JSRandom}, {"timestamp",0,(ScriptFunctionCall)*JSTimeStamp}, {"timedate",0,(ScriptFunctionCall)*JSTimeDate}, {"timetime",0,(ScriptFunctionCall)*JSTimeTime}, {"uniqueid",1,(ScriptFunctionCall)*JSUniqueId}, {"subStr",3,(ScriptFunctionCall)*JSsubstr}, {"indexOf",4,(ScriptFunctionCall)*JSIndexOf}, {"length",1,(ScriptFunctionCall)*JSstrlen}, {0,0,0}}; ScriptEnvironment Global; memset(Global,0,sizeof(Global)); Global.htmlout = &result; Global.Functions = Functions; Global.argv0 = argv0; Global.config = Config; char* host = GetSetting(config,"SOAPHOST","127.0.0.1"); char* port = GetSetting(config,"SOAPPORT","80"); char* function = GetSetting(config,"SOAPFUNCTION",""); char* soapaction = GetSetting(config,"SOAPACTION","SUBMIT"); if (!*function) return 66; /* generate the SOAP command */ script = FileOpen(argv0,dbname,".val"); if (!ReadUntilWordS(script,0,"<SCRIPT NAME=\"SAVESOAP\"")) { rewind(script); /* 2003 and 2004 before SP1 didn't have quotes */ if (!ReadUntilWordS(script,0,"<SCRIPT NAME=SAVESOAP")) { CGIFCLOSE(script);script=NULL; return 65; } } ReadUntilChar(script,0,0,">"); memset(&result,0,sizeof(result)); result.t = NewBuffer(1024); ret = RunScript(&Global,script,Params,Plugins,0); if (ret > 0) { PrintScriptError(htmlout,&Env, script, ret); } CGIFCLOSE(script); if (ret) return ret; c = CopyBuffer(result.t); if (SOAPExec(host, atoi(port), function, soapaction, c)) ret = 68; CGIFREE(c); DeleteBuffer(result.t); } #endif #ifdef CGI_ODBC if (atoi(GetSetting(config,"SAVEODBC","0"))) { SQLDB* db = 0; char* idfields = GetSetting(config,"IDFIELDS","IFMUID,IFMUID1,IFMUID2,IFMUID3,IFMUID4"); /* First, try to UPDATE the database. If that doesn't work, try UPDATE */ db = ODBCConnect( GetSetting(config,"ODBCSERVICE",""), GetSetting(config,"ODBCNAME",""), GetSetting(config,"ODBCPASSWORD",""),0); if (!db) { LogError("\nODBCOpen() failed"); return 52; } /* If Update fails, there's no need to write error log information. We hope it means that the record isn't present */ ret = -1; if (*idfields) { CGINameValue* Userid = ReadPairedString(idfields,',',0); int i; int any = 0; for(i=0; any == 0 && Userid[i].name; i++) any = GetFieldValue(Params,Userid[i].name)[0]; DeleteNVP(Userid); if (any != 0) ret = TryODBC(db, argv0, dbname, config, Params, "<SCRIPT NAME=\"UPDATEODBC\""); } if (ret) { ret = TryODBC(db, argv0, dbname, config, Params, "<SCRIPT NAME=\"SAVEODBC\""); } if (ret == -1) { LogError("\nSQLExec Statement had no effect "); } else if (ret) /* both update and save failed */ { char*c; LogError("\nSQLExec Failure:\n------\n"); c = CopyBuffer(db->ErrorMessage); LogError(c); LogError("\n------"); CGIFREE(c); } else { ODBCCommit(db); } ODBCDisconnect(db); if (ret) return ret; } #endif /* save succeeded! */ SetRespcount(argv0,dbname,respcount+1); return 0; }

int SecurityError (  EZSSTREAM *  htmlout, CGINameValue *  Params, char *  dbname, char *  action, int  error )

Definition at line 1878 of file ezs.c. References CGI_ALLOW_APPEND, CGI_ALLOW_REPORT, CGI_ALLOW_UPDATE, HTMLEscape(), and HTMLWrite(). Referenced by CGImain(). { int i; HTMLWrite(htmlout,"<H3>Permission denied</H3>\n"); HTMLWrite(htmlout,"<P>Please enter your password to "); if (error == CGI_ALLOW_UPDATE) HTMLWrite(htmlout,"update data in"); else if (error == CGI_ALLOW_APPEND) HTMLWrite(htmlout,"append data to"); else if (error == CGI_ALLOW_REPORT) HTMLWrite(htmlout,"view reports of"); else HTMLWrite(htmlout,"use"); HTMLWrite(htmlout," this file.\n"); #ifdef __WINCE__ HTMLWrite(htmlout,"<P><FORM ACTION=/ezs METHOD=POST ACCEPT-CHARSET=\"UTF-8\">"); #else HTMLWrite(htmlout,"<P><FORM METHOD=POST ACCEPT-CHARSET=\"UTF-8\">"); #endif HTMLWrite(htmlout,"\n<INPUT TYPE=HIDDEN NAME=DATABASE VALUE=\""); HTMLWrite(htmlout,dbname); HTMLWrite(htmlout,"\">\n<INPUT TYPE=HIDDEN NAME=_ACTION VALUE=\""); HTMLWrite(htmlout,action); HTMLWrite(htmlout,"\">\n"); for (i=0; Params[i].name; i++) { if (!Params[i].name[0]) continue; HTMLWrite(htmlout,"<INPUT TYPE=HIDDEN NAME=\""); HTMLEscape(htmlout,Params[i].name); HTMLWrite(htmlout,"\" VALUE=\""); HTMLEscape(htmlout,Params[i].value); HTMLWrite(htmlout,"\">\n"); } HTMLWrite(htmlout,"<INPUT TYPE=PASSWORD NAME=_PASSWORD> <INPUT TYPE=SUBMIT VALUE=\"Login\"></FORM><HR>"); return 101; }

int SetRespcount (  char *  argv0, char *  dbname, int  i )

Definition at line 1260 of file ezs.c. References CGIFOPEN, ExpandLocalPath(), and MAXPATH. { char filename[MAXPATH]; FILE * f; ExpandLocalPath(argv0,filename,dbname,".respcount"); f = CGIFOPEN(filename,"wb"); if (f) { fwrite(&i,sizeof(i),1,f); fclose(f); return 1; } return 0; }

int ShowForm (  char *  argv0, EZSSTREAM *  htmlout, char *  formname, CGINameValue *  Params )

Definition at line 825 of file ezs.c. References CheckFileName(), FileOpen(), NULL, and RunReport(). Referenced by CGImain(). { FILE * f = NULL; if (!formname) return 2; if (!*formname) return 2; if (CheckFileName(formname,"html,htm")) f = FileOpen(argv0,formname,""); if (!f) f = FileOpen(argv0,formname,".html"); if (!f) return 2; RunReport(argv0,htmlout,f,Params,NULL,NULL,1,NULL); fclose(f); return 0; }

int ShowFormPage (  char *  argv0, EZSSTREAM *  htmlout, char *  dbname, CGINameValue *  Params, char *  history, char *  curpage )

Definition at line 845 of file ezs.c. References CGIFCLOSE, CGIFOPEN, CGIFREE, CopyList(), DeleteNVP(), ExpandLocalPath(), FileOpen(), GetField(), GetFieldValue, HasToken(), HasTokenI(), HTMLEscape(), HTMLWrite(), HTMLWriteFile(), LogError(), MAXPATH, NULL, ReadHTMLAttributes(), ReadPairedString(), ReadUntilChar(), ReadUntilWordS(), RenameField(), RunReport(), SetFieldValue(), SLASH, strdup3(), and strnicmp(). Referenced by CGImain(). { char dbdir[MAXPATH]; char filename[MAXPATH]; char temp[1024]; int i, p; FILE * config; FILE * script; CGINameValue * Options = NULL; CGINameValue * unused = CopyList(Params,0); /* char* pagenext, *pageback, *next; */ if (curpage[0] == 'P') curpage[0] = 'p'; /* check that curpage doesn't try to sneak into another directory */ /* also, may not access file names with periods in them */ i = strcspn(curpage,"/.\\*?$|'\"<>~"); if (curpage[i] != 0) return 104; /* Kluge: starting each page name with "page" takes up too much space in the database. So let's strip out the word "page" from the history, and prepend "page" if necessary when loading the page data. */ if (history && *history) { char * x = history; char * y = history; while (*x) { if (!strncmp(x,"page",4)) x += 4; else *y++ = *x++; } *y = 0; } ExpandLocalPath(argv0,dbdir,dbname,SLASH); /* open the page file */ strcpy(filename,dbdir); strcat(filename,curpage); config = CGIFOPEN(filename,"rb"); if (!config && !strstr(curpage,"page")) { strcpy(filename,dbdir); strcat(filename,"page"); strcat(filename,curpage); config = CGIFOPEN(filename,"rb"); } /* look for page information */ if (!config) { HTMLWrite(htmlout,"<P>Error: page data missing for page"); HTMLEscape(htmlout,curpage); HTMLWrite(htmlout," "); HTMLEscape(htmlout,filename); LogError("\nCould not open page data file "); LogError(filename); return 2; } script = FileOpen(argv0,dbname,".val"); if (script != NULL) {/*EZS2003: config info in the .val file. All we need are the INCLUDE, ACTION, and METHOD tags. The rest is in the HTML. */ /* prepend "page" if necessary */ char* check ; if (!strnicmp(curpage,"page",4)) curpage += 4; check = strdup3("<PAGE NAME=\"page",curpage,"\""); if (ReadUntilWordS(script,0,check)) Options = ReadHTMLAttributes(script,32); CGIFCLOSE(script); CGIFREE(check); } temp[0]=0; if (!Options || !GetField(Options,"ACTION")) /* ACTION added in 2003 */ {/*EZS2000-2002: config info at the top of each HTML file */ /* send the header */ strcpy(filename,dbdir); strcat(filename,"header"); HTMLWriteFile(htmlout,filename); /* start the form */ ReadUntilChar(config,temp,sizeof(temp),"\n",'\r'); /* read 1k config */ Options = ReadPairedString(temp,'&',0); ReadUntilChar(config,0,0,"\n",'\r'); /* unused line */ /* read the included file list. actually, it's just one file. */ ReadUntilChar(config,temp,sizeof(temp),"\n",'\r'); /* read 1k config */ } /* scan until the form tag and replace it with ours */ RunReport(argv0,htmlout,config,Params,0,unused,1,"FORM"); /* RunReport always finishes the tag if possible. if (i != '>' && i != EOF) ReadUntilChar(config,0,0,">"); */ HTMLWrite(htmlout, "<FORM NAME=F onSubmit=\"return ezsOnSubmit(this);\" ACCEPT-CHARSET=\"UTF-8\""); #ifdef __WINCE__ HTMLWrite(htmlout," ACTION=/ezs METHOD=POST"); #else if (GetField(Options,"ACTION")) { HTMLWrite(htmlout," ACTION=\""); HTMLWrite(htmlout,GetFieldValue(Options,"ACTION")); HTMLWrite(htmlout,"\""); } if (GetField(Options,"AUTOCOMPLETE")) { HTMLWrite(htmlout," AUTOCOMPLETE=\""); HTMLWrite(htmlout,GetFieldValue(Options,"AUTOCOMPLETE")); HTMLWrite(htmlout,"\""); } if (GetField(Options,"METHOD")) { HTMLWrite(htmlout," METHOD=\""); HTMLWrite(htmlout,GetFieldValue(Options,"METHOD")); HTMLWrite(htmlout,"\""); } else HTMLWrite(htmlout," METHOD=POST"); #endif HTMLWrite(htmlout,">\n"); /* pageback = GetFieldValue(Options,"PAGEBACK"); pageback = GetFieldValue(Params,"_PAGEBACK"); pagenext = GetFieldValue(Params,"_PAGENEXT"); */ /*next = GetFieldValue(Options,"PAGENEXT");*/ /* pagenext could be a comma-delimited list of places we need to visit. They take prescedence over the default _PAGENEXT value that is written into the HTML file. The default _PAGENEXT value is also given to us as PAGENEXT in the Options list. */ /* we've visited this page, so remove it from the list */ #if 0 if (*pagenext) {/* generate a new _PAGENEXT value to replace the one in the file*/ if (HasToken(pagenext,next,0)) {/* do nothing -- _PAGENEXT stays as is */ } else {/* add 'next' to the end of pagenext, so that we can skip to a group of pages. The last set of page names before a space will be stripped when going back. */ char * x = strdup3(pagenext," ",next); SetFieldValue(Params,"_PAGENEXT",x); CGIFREE(x); } } else { RenameField(Params,"_PAGENEXT",0); } #endif HTMLWrite(htmlout,"<INPUT TYPE=HIDDEN NAME=DATABASE VALUE=\""); HTMLWrite(htmlout,dbname); HTMLWrite(htmlout,"\">\n"); HTMLWrite(htmlout,"<INPUT TYPE=HIDDEN NAME=_PAGEBACK VALUE=\""); HTMLWrite(htmlout,history); HTMLWrite(htmlout,"\">\n"); RenameField(Params,"_PAGEBACK",0); RenameField(Params,"_PAGE",0); RenameField(Params,"_PAGESKIP",0); /* don't remove the DATABASE field: we need to write it on each form */ /* We used to rename these fields earlier, but that resulted in clearing the curpage variable. Oops! */ /* send the included files -- only one file for now */ if(*temp) { strcpy(filename,dbdir); strcat(filename,temp); HTMLWriteFile(htmlout,filename); } /* pretend to run the report, so we can find the unused field names */ p = ftell(config); RunReport(argv0,0,config,Params,NULL,unused,1,"/FORM"); /* send the hidden field data */ for (i = 0; unused[i].name; i++) { if (!unused[i].name[0]) continue; /* skip fields that have already been printed */ /*name is short, but value could be long*/ if (!HasTokenI("HOST,DATE,TIME",unused[i].name,0) && strncmp("_PAGE",unused[i].name,5) ) /* skip special fields */ { HTMLWrite(htmlout,"<INPUT TYPE=HIDDEN NAME=\""); HTMLEscape(htmlout,unused[i].name); HTMLWrite(htmlout,"\" VALUE=\""); HTMLEscape(htmlout,unused[i].value); HTMLWrite(htmlout,"\">\n"); } } /* send the remaining page data */ fseek(config,p,SEEK_SET); RunReport(argv0,htmlout,config,Params,NULL,unused,1,0); CGIFCLOSE(config); DeleteNVP(unused); DeleteNVP(Options); /* send the footer */ // strcpy(filename,dbdir); // strcat(filename,"footer"); // HTMLWriteFile(htmlout,filename); return 0; }

void ShowProgramStatus (  EZSSTREAM *  htmlout, int  Security )

Definition at line 1853 of file ezs.c. References CGI_ALLOW_ADMIN, CGI_ALLOW_APPEND, CGI_ALLOW_DELETE, CGI_ALLOW_NONE, CGI_ALLOW_READ, CGI_ALLOW_UPDATE, CGI_ALLOW_WRITE, and HTMLWrite(). Referenced by CGImain(). { if (Security == CGI_ALLOW_NONE) { HTMLWrite(htmlout,"<P>You are not permitted to use this server."); } else { HTMLWrite(htmlout,"<P>With this database, you may:<UL>"); if (Security & CGI_ALLOW_READ) HTMLWrite(htmlout,"<LI>Read data\n"); if (Security & CGI_ALLOW_WRITE) HTMLWrite(htmlout,"<LI>Edit records\n"); if (Security & CGI_ALLOW_UPDATE) HTMLWrite(htmlout,"<LI>Update existing records\n"); if (Security & CGI_ALLOW_APPEND) HTMLWrite(htmlout,"<LI>Append new records\n"); if (Security & CGI_ALLOW_ADMIN) HTMLWrite(htmlout,"<LI>Administer the database\n"); if (Security & CGI_ALLOW_DELETE) HTMLWrite(htmlout,"<LI>Delete records\n"); HTMLWrite(htmlout,"</UL>"); } }

static int SortFunction (  const void *  a0, const void *  b0 )  [static]

Definition at line 549 of file ezs.c. References CGINameValue::value. Referenced by SortNVP(). { CGINameValue* a = (CGINameValue*)a0; CGINameValue* b = (CGINameValue*)b0; int x=0,y=0; if (a->value) x = atoi(a->value); if (b->value) y = atoi(b->value); return x - y; };

void SortNVP (  CGINameValue *  list  )

Definition at line 559 of file ezs.c. References NULL, and SortFunction(). Referenced by JSRankSort(). { size_t x= 0; while (list[x].name != NULL) x++; qsort(list,x,sizeof(CGINameValue),*SortFunction); }

int TryODBC (  SQLDB *  db, char *  argv0, char *  dbname, CGINameValue *  config, CGINameValue *  Params, char *  script )

Definition at line 1197 of file ezs.c. References CGIFREE, CopyBuffer(), DeleteBuffer(), LogError(), NewBuffer(), ODBCExec(), and ODBCRunScript(). { char *c; int ret; EZSSTREAM result; int rowsUpdated = 0; memset(&result,0,sizeof(result)); result.t = NewBuffer(1024); ret = ODBCRunScript(argv0,&result,dbname,config,Params,script); if (ret) { char s[128]; sprintf(s,"ODBCRunScript error %d for ",ret); LogError(s); LogError(script); } c = CopyBuffer(result.t); DeleteBuffer(result.t); if (ret) { LogError(c); CGIFREE(c); return ret; } if (*c) ret = ODBCExec(db,c,&rowsUpdated); if (ret) { char s[128]; sprintf(s,"\nODBCRunScript error %d",ret); LogError(s); } CGIFREE(c); if (ret) return ret; if (rowsUpdated == 0) return -1; /* code had no effect */ return 0; }

int ValidateBack (  char *  argv0, EZSSTREAM *  htmlout, char *  dbname, CGINameValue *  Config, CGINameValue *  Params, char *  page )

Definition at line 759 of file ezs.c. References CGIFCLOSE, CGIFREE, FileOpen(), GetField(), JSEval(), JSGetEnv(), JSIndexOf(), JSPrint(), JSRandom(), JSReport(), JSSendMail(), JSShowPage(), JSstrlen(), JSsubstr(), JSTimeDate(), JSTimeStamp(), JSTimeTime(), JStoFixed(), JSToNumber(), JSUniqueId(), NULL, PrintScriptError(), ReadUntilWordS(), RenameField(), RunScript(), and strdup3(). Referenced by CGImain(). { char *check; int ret; FILE* script; ScriptFunction Functions[] = { {"print",10,(ScriptFunctionCall)*JSPrint}, {"write",10,(ScriptFunctionCall)*JSPrint}, {"eval",1,(ScriptFunctionCall)*JSEval}, {"timestamp",0,(ScriptFunctionCall)*JSTimeStamp}, {"timedate",0,(ScriptFunctionCall)*JSTimeDate}, {"timetime",0,(ScriptFunctionCall)*JSTimeTime}, {"uniqueid",1,(ScriptFunctionCall)*JSUniqueId}, {"toFixed",2,(ScriptFunctionCall)*JStoFixed}, {"sendMail",3,(ScriptFunctionCall)*JSSendMail}, {"showpage",1,(ScriptFunctionCall)*JSShowPage}, {"runReport",8,(ScriptFunctionCall)*JSReport}, {"number",1,(ScriptFunctionCall)*JSToNumber}, {"environment",1,(ScriptFunctionCall)*JSGetEnv}, {"toNumber",1,(ScriptFunctionCall)*JSToNumber}, {"random",1,(ScriptFunctionCall)*JSRandom}, {"subStr",3,(ScriptFunctionCall)*JSsubstr}, {"indexOf",4,(ScriptFunctionCall)*JSIndexOf}, {"length",1,(ScriptFunctionCall)*JSstrlen}, {0,0,0}}; ScriptEnvironment Global; memset(&Global,0,sizeof(Global)); Global.htmlout = htmlout; Global.Functions = Functions; Global.argv0 = argv0; Global.config = Config; if (!page || !*page) return 0; script = FileOpen(argv0,dbname,".val"); if (script == NULL) return 1; /* OK */ check = strdup3("<PAGE NAME=\"",page,"\""); if (!ReadUntilWordS(script,0,check)) {CGIFCLOSE(script);script=NULL;CGIFREE(check); return 0; } CGIFREE(check); if (!ReadUntilWordS(script,0,"<SCRIPT TYPE=BACK>")) {CGIFCLOSE(script);script=NULL; return 0; } if (!GetField(Params,"_PAGEWARN")) RenameField(Params,"","_PAGEWARN"); if (!GetField(Params,"_PAGENEXT")) RenameField(Params,"","_PAGENEXT"); if (!GetField(Params,"_PAGESKIP")) RenameField(Params,"","_PAGESKIP"); ret = RunScript(&Global,script,Params); if (ret > 0) { PrintScriptError(htmlout,&Global, script, ret); } CGIFCLOSE(script); return 0; }

int ValidatePage (  char *  argv0, EZSSTREAM *  htmlout, char *  dbname, CGINameValue *  Config, CGINameValue *  Params, char *  page )

Doesn't do a proper XML parsing, but scans for the page's entry in the .val file. The <SCRIPT> tag is assumed to be in our modified JavaScript language. Since it isn't parsed, > and < may be used in the script. For the perl version, scan for <Script language="perl>"> instead. Example: <?xml version="1.0" ?> <!DOCTYPE VALIDATE SYSTEM "http://www.raosoft.com/xml/validate.dtd"> <VALIDATE source="form.ezf"> <page name="page4>"> <script language="EZSURVEY2004>"> </script> </page> <submit> <script>JS submit script </script> <script language="Perl>">Perl submit script </script> </submit> </VALIDATE> Definition at line 691 of file ezs.c. References CGIFCLOSE, CGIFREE, FileOpen(), GetField(), JSEval(), JSGetEnv(), JSIndexOf(), JSPrint(), JSRandom(), JSRankIndex(), JSRankSort(), JSReport(), JSSendMail(), JSShowPage(), JSstrlen(), JSsubstr(), JSTimeDate(), JSTimeStamp(), JSTimeTime(), JStoFixed(), JSToNumber(), JSUniqueId(), NULL, PrintScriptError(), ReadUntilWordS(), RenameField(), RunScript(), and strdup3(). Referenced by CGImain(). { char *check; int ret; FILE* script; ScriptFunction Functions[] = { {"print",10,(ScriptFunctionCall)*JSPrint}, {"write",10,(ScriptFunctionCall)*JSPrint}, {"eval",1,(ScriptFunctionCall)*JSEval}, {"timestamp",0,(ScriptFunctionCall)*JSTimeStamp}, {"timedate",0,(ScriptFunctionCall)*JSTimeDate}, {"timetime",0,(ScriptFunctionCall)*JSTimeTime}, {"uniqueid",1,(ScriptFunctionCall)*JSUniqueId}, {"tofixed",2,(ScriptFunctionCall)*JStoFixed}, {"sendmail",3,(ScriptFunctionCall)*JSSendMail}, {"showpage",1,(ScriptFunctionCall)*JSShowPage}, {"ranksort",128,(ScriptFunctionCall)*JSRankSort}, {"rankindex",2,(ScriptFunctionCall)*JSRankIndex}, {"runReport",8,(ScriptFunctionCall)*JSReport}, {"number",1,(ScriptFunctionCall)*JSToNumber}, {"environment",1,(ScriptFunctionCall)*JSGetEnv}, {"toNumber",1,(ScriptFunctionCall)*JSToNumber}, {"random",1,(ScriptFunctionCall)*JSRandom}, {"subStr",3,(ScriptFunctionCall)*JSsubstr}, {"indexOf",4,(ScriptFunctionCall)*JSIndexOf}, {"length",1,(ScriptFunctionCall)*JSstrlen}, {0,0,0}}; ScriptEnvironment Global; memset(&Global,0,sizeof(Global)); Global.htmlout = htmlout; Global.Functions = Functions; Global.argv0 = argv0; Global.config = Config; if (!page || !*page) return 0; script = FileOpen(argv0,dbname,".val"); if (script == NULL) return 1; /* OK */ check = strdup3("<PAGE NAME=\"",page,"\""); if (!ReadUntilWordS(script,0,check)) {CGIFCLOSE(script);script=NULL;CGIFREE(check); return 0; } CGIFREE(check); if (!ReadUntilWordS(script,0,"<SCRIPT")) {CGIFCLOSE(script);script=NULL; return 0; } if (!ReadUntilWordS(script,0,">")) {CGIFCLOSE(script);script=NULL; return 0; } if (!GetField(Params,"_PAGEWARN")) RenameField(Params,"","_PAGEWARN"); if (!GetField(Params,"_PAGENEXT")) RenameField(Params,"","_PAGENEXT"); if (!GetField(Params,"_PAGESKIP")) RenameField(Params,"","_PAGESKIP"); ret = RunScript(&Global,script,Params); if (ret > 0) { PrintScriptError(htmlout,&Global, script, ret); } CGIFCLOSE(script); return 0; }

Raosoft EZReport, EZSurvey, InterForm, RapidReport, Raosoft, and SurveyWin are registered trademarks of Raosoft, Inc. Page contents © 1996-2007 by Raosoft, Inc. You may use and modify this file for your own use, but may not distribute it or derivative works without the prior written consent of Raosoft, Inc. This software is provided "as is," and Raosoft makes no warranty, express or implied, of fitness for a particular application. Every measure has been taken to anticipate risks inherent to computer networks, but we cannot guarantee safety or reliability of this program in every situation.

Tel: 206-525-4025 (US) Email: raosoft@raosoft.com
http://www.raosoft.com/