Commit Graph

45 Commits

Author SHA1 Message Date
David Anderson 364662f1dc web: add missing _mysql_fetch_array() definition 2015-07-02 10:55:59 -07:00
David Anderson 6b9205b3a1 web: fix SQL injection vulnerability in remote job submission
Also cast ID to int in lookup_id.
This isn't a vulnerability AFAIK, but doesn't hurt to be safe
2014-11-21 15:37:40 -08:00
David Anderson ae1b16914f web: don't use persistent connections with mysqli
I recently changed the web code to use the PHP mysqli interface if available.
I noticed that it often get "can't connect - too many connections" errors,
even on small projects.
This is probably due to the use of persistent connections, so I took that out.
2014-10-21 22:12:03 -07:00
David Anderson 41068fb802 web: fix explode() arg order 2014-10-02 00:54:17 -07:00
David Anderson 469b82ef0e web: allow <db_host> to include :port 2014-10-01 08:31:38 -07:00
David Anderson 2ea2077b2b web: change NO_MYSQLI feature to fix recursive-include problems
I seemed to be playing whack-a-mole with problems related to
recursive inclusions of project.inc.
Solve this by changing how the use of mysqli can be inhibited:
instead of defining NO_MYSQL in project, put <no_mysqli/> in config.xml
2014-09-28 12:15:26 -07:00
David Anderson 1c60e467a7 web: add page (per_app_list.php) to show top users/teams by app
Notes:
- it's per app, not per sub-project; that would have been harder
- it only shows the top 20

Also: shuffle code to reduce recursive includes.
2014-09-28 08:11:51 -07:00
David Anderson cacbd3e39b web: comment tweak 2014-09-28 00:25:08 -07:00
David Anderson 04686222f5 web: tweak to last commit; to not use mysqli_*, define NO_MYSQLI 2014-09-24 11:25:28 -07:00
David Anderson c02362ecd1 web: let projects not use mysqli if they want
projects may have developed a lot of PHP code that uses the
old mysql_* interface.
Let them keep using this interface by putting
define('MYSQLI', false);
in project/project.inc
2014-09-24 10:37:10 -07:00
David Anderson 3abed383e5 web PHP code: use mysqli everywhere if available
Change all the PHP code to use _mysql_query() instead of mysql_query()
(and similar for other functions).
_mysql_query() uses the mysqli API if available, else the old API.

Going forward, all PHP code should the DB abstration layer if possible;
else it should use the _mysql_* functions.
2014-09-04 12:00:09 -07:00
David Anderson 29f2cf2cb9 web: add error-checking in DB interface layer 2014-06-19 15:22:52 -07:00
David Anderson ec8200d0eb Web: in PHP < 5.3.0, mysqli doesn't support persistent connections 2014-04-11 11:02:12 -07:00
David Anderson 6216673eca web: fix missing mysqli change 2014-03-22 09:04:58 -07:00
David Anderson 8e59a5b2ae web: if present, use the mysqli interface to MySQL.
The older interface is deprecated and may eventually be removed.
Note: some of the more ancient PHP code directly uses the old interface.
We'll have to update this at some point.
2014-03-21 01:08:47 -07:00
David Anderson fe1db8060a Remote job submission: allow a limit on the # of in-progress jobs per user 2014-01-13 21:52:55 -08:00
David Anderson b33bf69a98 web: enhance badge features
- the default badges (defined in ops/badge_assign.php) are now
  based on RAC percentile (top 1%, 5%, and 25%) rather than plain RAC.
- RAC percentile badges are now granted for teams as well as users;
  show badges in team page.
- move badge utility functions to inc/util_ops.inc
2013-12-20 15:03:24 -08:00
David Anderson 00897ecc3f web: remove some mysql_* calls 2013-12-16 19:22:34 -08:00
David Anderson 1872fd0f6b web: eliminate some mysql_*() calls in preparation for mysqli conversion 2013-11-22 22:46:19 -08:00
David Anderson a6af5bf272 - remote job submission tweaks 2013-03-05 17:10:31 +01:00
David Anderson 2db88e20a8 - web: add DbConn::max() function
svn path=/trunk/boinc/; revision=25711
2012-05-25 18:44:56 +00:00
David Anderson 8a9605e48c - web: add a web-service interface for remotely submitting, querying
and controlling batches of jobs
- web: add an administrative interface for controlling
    user permissions for submitting jobs
- web: add an interface where users can view and control
    their submitted jobs
See: http://boinc.berkeley.edu/trac/wiki/RemoteJobs
This is at a functional but rough stage.


svn path=/trunk/boinc/; revision=23762
2011-06-21 22:56:15 +00:00
David Anderson bbaff5d2da - web: remove DBNAME hack, which allowed users to see the DB name
(not a big deal, but bad form).
    Fixes #1028

svn path=/trunk/boinc/; revision=22748
2010-11-25 05:54:09 +00:00
David Anderson e7dcff182f - web DB code: fix PHP warning when enumeration returns nothing.
From Nicolas. fixes #974
- client: tiny code shuffle

svn path=/trunk/boinc/; revision=20178
2010-01-15 23:08:55 +00:00
David Anderson 71c7e7a74b - client/scheduler/web: add per-project preferences for whether
to accept CPU, NVIDIA and ATI jobs.
    These prefs are shown only where relevant:
    e.g., only for processor types for which the project has app versions,
    and if it has versions for only one type, no pref is shown.

    These prefs affect both client and scheduler.
    The client won't ask for work for a device blocked by prefs,
    and the scheduler won't send it.

    This replaces earlier optional project-specific prefs for
    "no CPU jobs" and "no GPU jobs".
    (However, these prefs continue to be honored on the server side).

- client: if NVIDIA driver is unknown, say that rather than 0


svn path=/trunk/boinc/; revision=19194
2009-09-28 04:24:18 +00:00
David Anderson 50405c89e3 - scheduler: improve no-work messages
- web: don't use DB conn in mysql_real_escape_string()
    (otherwise won't work if DB is down)

svn path=/trunk/boinc/; revision=16961
2009-01-20 21:31:13 +00:00
David Anderson 8c7d6dc489 - web: added ops/autolock.php script;
locks threads not modified in last 60 days

svn path=/trunk/boinc/; revision=16704
2008-12-16 23:59:04 +00:00
David Anderson 1de55a2842 - web: free result in count(). Fixes #763
svn path=/trunk/boinc/; revision=16389
2008-11-02 20:15:06 +00:00
David Anderson f17c0879de - changed some comments for Doxygen
svn path=/trunk/boinc/; revision=16130
2008-10-04 23:44:24 +00:00
David Anderson c69186ef74 - remove "doc_file" field; use short_name.inc
- fix tabl_exists()
- fix bugs when return to answer page
- create bolt_result records correctly

svn path=/trunk/boinc/; revision=15836
2008-08-14 15:46:30 +00:00
David Anderson 9baf78fe5f - web: added copyright and license info to PHP files
svn path=/trunk/boinc/; revision=15758
2008-08-05 22:43:14 +00:00
David Anderson 0f60f0d42b - scheduler: fix bug where a pointer to a 32-bit time field
was being cast to a pointer to 64-bit time field
    (this caused wrong results on 64-bit servers)
    From Sharov Artyom.

svn path=/trunk/boinc/; revision=15517
2008-06-30 23:05:16 +00:00
David Anderson 724e89ebab - web: if user has profile photo, use it instead of head_20.
svn path=/trunk/boinc/; revision=14438
2007-12-23 23:09:10 +00:00
David Anderson be20ad2af2 - web: updating forum prefs would undo banishment,
reset #posts, and clear moderator flags.  Fixed.


svn path=/trunk/boinc/; revision=14324
2007-11-29 23:26:49 +00:00
David Anderson 0616e75a02 - user web: update other code to use new-style DB interfaces
svn path=/trunk/boinc/; revision=14164
2007-11-12 22:28:17 +00:00
David Anderson aa7b9f2547 - DB: fix typo in schema
svn path=/trunk/boinc/; revision=14141
2007-11-12 16:00:37 +00:00
David Anderson bf227ea8b1 - DB: remove "lang" from schema - not used
- DB: added parent_type to forum
- user web: BoincUser uses caching by default
- client: fixed small memory leak in statistics parsing

svn path=/trunk/boinc/; revision=14130
2007-11-10 00:32:42 +00:00
David Anderson fb8b4ffabb - user web: added the notion of "Team Admin": team members,
appointed by the founder, who have most of the same
    rights as the founder (edit team info, view/remove users).
    They can't, however, change the founder, or select/remove Admins.
- user web: added the ability for founder to delete an empty team
- user web: count/show all team members, not just those with credit
- user web: Team Search returns top team if form fields left blank
- Added db_update.php entry for Eric's banishment_vote stuff

svn path=/trunk/boinc/; revision=14108
2007-11-07 17:23:29 +00:00
David Anderson c35f02e868 - user web: add a general-purpose user search mechanism.
This lets you lookup up users sorted by
        - descending join time
        - descending total credit, or
        - descending RAC
    and lets you filter them by
        - country
        - presence/absence of team
        - presence/absence of profile
    It's implemented in such a way that no more than N
    DB rows are examined
    (i.e. it doesn't necessarily show you all the results)
- PHP database: add enum_fields() member to DbConn and BoincUser.
    This is to select a limited number of fields
    e.g. to make large queries more efficient.
    Also added BoincTeam::lookup_id_cache(); this is an example
    of how to look up items likely to be repeated
    (like teams when you're showing a list of users)

svn path=/trunk/boinc/; revision=14082
2007-11-05 23:55:33 +00:00
Rytis Slatkevičius 575673298f Do not display PHP notices and warnings on production code anymore
svn path=/trunk/boinc/; revision=13995
2007-10-30 17:54:29 +00:00
David Anderson e1ca1c5aee - User web: more DB framework changes;
extended DB framework to allow use of a read-only replica

svn path=/trunk/boinc/; revision=13985
2007-10-29 16:38:25 +00:00
David Anderson ee1621c566 - user web: more of the above.
Also, try to make it PHP 4 compatible

svn path=/trunk/boinc/; revision=13982
2007-10-29 04:02:41 +00:00
David Anderson dc4ca1e5cd - user web: changes to use new DB framework and eliminate PHP warnings
svn path=/trunk/boinc/; revision=13981
2007-10-28 15:03:14 +00:00
David Anderson ee4e3fba01 - user web: Add BoincDb::escape_string(),
and have boinc_real_escape_string 
    call it rather than mysql_real_escape_string(),
    to ensure that a DB connection exists
    (you need one to call mysql_real_escape_string()).
- some additional conversion to BoincDb-based classes

svn path=/trunk/boinc/; revision=13977
2007-10-27 20:38:12 +00:00
David Anderson 7302f02544 - user web: added new framework for DB access from PHP.
Here's how things should eventually be:
    - inc/db_conn.inc defines DbConn, a PHP class representing
        a connection to a database with
        various generic operations (update, insert etc.).
        DbConn prepends the DB name to table names,
        so you don't have to select a DB;
        this means you can access multiple databases
        (e.g. BOINC and Bossa) and use persistent connections.
        ALL MYSQL-SPECIFIC CODE WILL EVENTUALLY BE HERE.
    - inc/boinc_db.inc defines classes BoincUser, BoincTeam etc.,
        representing the various BOINC DB tables.
        All access to the DB should use these classes.

    When you use this framework, no initialization calls are needed.
    db.inc is deprecated and should eventually be removed.

    I changed get_logged_in_user()
    and all team-related code to use this framework.
- user web: show team founder link to "management functions"
    even if they're not currently a member;
    allow team founder to perform all operations even if not a member.
- turned on E_ALL error checking,
    and fixed a bunch of warnings
    and a couple of bugs ($team, not team)

- database: update schema/constraints for team fulltext search
- user web: forgot to change Serbia and Montenegro to Serbia

svn path=/trunk/boinc/; revision=13968
2007-10-26 21:14:35 +00:00