consolidated mails to the same sender

jbs1 · Feb 17, 2019 · 42d5ad6 · 42d5ad6
1 parent 366c7c1
commit 42d5ad6
Show file tree

Hide file tree

Showing 14 changed files with 188 additions and 131 deletions.
diff --git a/README.md b/README.md
@@ -27,11 +27,13 @@ If all endpoints are implemeted, it would remove the need to be ingame at all wh
 * [x] save sent mails in cookies instead of session, otherwise on session timeout sent mails not marked anymore
 * [x] fix "session already started" console warning
 * [x] save finished contracts in cookies to make persistent over sessions
+* [ ] fix eval vuln in mailform
+* [ ] fix deprecated async in hull mail form
 
 
 #### Tabs
 
-* [ ] for all tabs: first put in killmail to to fetch info such as reciever name/fit for comparison and to put it in text template
+* [ ] for all tabs: first put in killmail to to fetch info such as receiver name/fit for comparison and to put it in text template
   * [ ] support zkill and euni killboard by fetching actuall esi killmail from the pasted link
 * [ ] Money SRP
   * [ ] possibly make payments through api (NO endpoint yet)

diff --git a/ajax/get_contracts.php b/ajax/get_contracts.php
@@ -10,7 +10,7 @@
 	$result = $contracts->getCharactersCharacterIdContractsWithHttpInfo(charid(), $datasource);
 	foreach ($result[0] as $row) {
 		if((strtotime($row['date_issued'])>strtotime('-6 hour'))&&($row['status']=="outstanding"||$row['status']=="finished")&&$row['issuer_id']==charid()&&$row['availability']=="personal"&&$row['type']=="item_exchange"&&getcorpid($row['assignee_id'])==corpid()){
-			array_unshift($json,$row);//avoids protected property problems
+			array_unshift($json,$row);
 		}
 	}
 	print_r(json_encode(array($json,$result[2]['Expires'])));

diff --git a/ajax/get_payments.php b/ajax/get_payments.php
@@ -10,7 +10,7 @@
 	$result = $wallet->getCorporationsCorporationIdWalletsDivisionJournalWithHttpInfo(corpid(), $corpwallet_id, $datasource);
 	foreach ($result[0] as $row) {
 		if ((strtotime($row['date'])>strtotime('-6 hour'))&&$row['ref_type']=="corporation_account_withdrawal"&&$row['context_id_type']=="character_id"&&$row['context_id']==charid()&&$row['first_party_id']!=$row['second_party_id']&&$row['amount']<=0) {
-			array_unshift($json,$row);//avoids protected property problems
+			array_unshift($json,$row);
 		}
 	}
 	print_r(json_encode(array($json,$result[2]['Expires'])));	

diff --git a/ajax/get_station.php b/ajax/get_station.php
@@ -0,0 +1,16 @@
+<?php
+require_once(__DIR__.'/../header.php');
+
+header('Content-Type: application/json;charset=utf-8');
+
+$api_universe = new Swagger\Client\Api\UniverseApi(null,$config);
+
+
+try {
+	$station=$api_universe->getUniverseStationsStationId($_GET["station"], $datasource);
+    print_r($station->__toString());
+} catch (Exception $e) {
+    echo 'Exception when calling UniversieApi->getUniverseStationsStationId: ', $e->getMessage(), PHP_EOL;
+}
+
+?>
diff --git a/ajax/mail-messages.php b/ajax/mail-messages.php
@@ -5,52 +5,43 @@
 
 array structure:
 
-[<header>,<body>,<name>,<id>,<public>,<hidden>]
-
-<header> [optional]:
-Header e.g. for api methoded that are needed for the body
+[<body>,<name>,<id>,<public>]
 
 <body>:
 php echo string containing the body of the message
 
 <name>:
-name of the current templated e.g. for message selection list
+name of the current template e.g. for message selection list
 
 <id>:
 id that will be applied to the mail form for js reference
 
 <public>:
 whether it should show up in the general message list
 
-<hidden>:
-extra hidden input fields
 */
 
 $messages=array(
-['$api_universe = new Swagger\Client\Api\UniverseApi(null,$config);
-$station=$api_universe->getUniverseStationsStationId($_GET["station"], $datasource);',
-'echo "Hello,
+['echo "Hello,
 
-I have reviewed and approved your SRP request.
-Your replacement ship is available at the following station: <url=showinfo:".$station["type_id"]."//".$station["station_id"].">".$station["name"]."</url>
+I have reviewed and approved your SRP requests.
+The following contracts where create at the respective stations:
 
-The contract for the ship can be found here: <url=contract:".$station["system_id"]."//".$_GET["contractid"].">Contract</url>
+".$_GET["contract_string"]."
 
 Fly Safe,
 <url=showinfo:1377//". charid().">". $_SESSION["corpmem"][charid()] ."</url>
 <url=showinfo:2//". $_SESSION["charinfo"]["CorporationID"].">". $_SESSION["charinfo"]["CorporationName"]."</url>";',
 'Hull SRP Message',
 'hull_mail_form',
-false,
-'echo "<input type=\'hidden\' id=\'contract\' name=\'contract\' value=".$_GET[\'contractid\']."></input>";'
+false
 ],
-['',
-'echo "Hello,
+['echo "Hello,
 
 I have reviewed and approved your SRP requests.
 You have been paid for the following losses:
 
-".(isset($_GET["reason"])?$_GET["reason"]:\'[Loss not recorded]\').": ".$_GET["value"]." Million
+".$_GET["payment_string"]."
 
 Please check your wallet.
 
@@ -59,11 +50,9 @@
 <url=showinfo:2//". $_SESSION["charinfo"]["CorporationID"].">". $_SESSION["charinfo"]["CorporationName"]."</url>";',
 'ISK SRP Message',
 'isk_mail_form',
-false,
-'echo "<input type=\'hidden\' id=\'payment\' name=\'payment\' value=".$_GET[\'paymentid\']."></input>";'
+false
 ],
-['',
-'echo "Hello,
+['echo "Hello,
 
 We have received your ship replacement request.
 However there is at least one issue preventing us from fulfilling your request:
@@ -78,11 +67,9 @@
 <url=showinfo:2//". $_SESSION["charinfo"]["CorporationID"].">". $_SESSION["charinfo"]["CorporationName"]."</url>";',
 'Resubmission SRP Message',
 'messages_mail_form',
-true,
-''
+true
 ],
-['',
-'echo "Hello,
+['echo "Hello,
 
 Unfortunately we have had to decline your ship replacement request due to one or more reasons:
 
@@ -96,8 +83,7 @@
 <url=showinfo:2//". $_SESSION["charinfo"]["CorporationID"].">". $_SESSION["charinfo"]["CorporationName"]."</url>";',
 'Rejection SRP Message',
 'messages_mail_form',
-true,
-''
+true
 ]
 
 

diff --git a/ajax/mailform.php b/ajax/mailform.php
@@ -2,34 +2,25 @@
 require_once(__DIR__.'/../header.php');
 require_once(__DIR__.'/mail-messages.php');
 
-if(!empty($messages[$_GET['textid']][0])){
-	eval($messages[$_GET['textid']][0]);
-}
-?>
-
-<form id=<?php echo $messages[$_GET['textid']][3]; ?>>
-<?php
-if(!empty($messages[$_GET['textid']][5])){
-	eval($messages[$_GET['textid']][5]);
-}
 ?>
 
+<form id=<?php echo $messages[$_GET['textid']][2]; ?>>
 
 <div class="form-group">
-<label for="reciever">Reciever:</label>
-<input type="text" class="form-control" id="reciever-text" name="reciever-text" value="<?php echo $_SESSION['corpmem'][$_GET["assignee"]]; ?>" readonly>
+<label for="receiver">Receiver:</label>
+<input type="text" class="form-control" id="receiver-text" name="receiver-text" value="<?php echo $_SESSION['corpmem'][$_GET["assignee"]]; ?>" readonly>
 </div>
-<input type="hidden" id="reciever" name="reciever" value="<?php echo $_GET['assignee']; ?>"></input>
+<input type="hidden" id="receiver" name="receiver" value="<?php echo $_GET['assignee']; ?>"></input>
 
 <div class="form-group">
 <label for="subject">Subject:</label>
 <input type="text" class="form-control" id="subject" name="subject" value="Your Ship Replacement" readonly>
 </div>
 
 <div class="form-group">
-<label for="mail-body">Mail Body</label>
+<label for="mail-body">Mail Body:</label>
 <textarea class="form-control" id="mail-body" name="mail-body" rows="15">
-<?php eval($messages[$_GET['textid']][1]);?>
+<?php eval($messages[$_GET['textid']][0]);?>
 </textarea>
 <span class="help-block">To add links they have to be in the format &quot;&lt;url=[target-url]&gt;[some text]&lt;/url&gt;&quot;.</span>
 </div>

diff --git a/ajax/sendmail.php b/ajax/sendmail.php
@@ -15,33 +15,7 @@
 
 try {
     $result = $api_instance->postCharactersCharacterIdMail(charid(), $mail, $datasource);
-
-    /**
-    only save in session if successful
-	switch/case for special cases such as contract srp for additional after mail actions
-	**/
-    if(isset($_POST["special"])){
-    	switch ($_POST["special"]) {
-    		case 'contract':
-    			if(!isset($_COOKIE['finished_contracts'])){
-					setcookie('finished_contracts[0]',$_POST["contractid"],time()+60*60*24,'/');
-				}elseif (!in_array($_POST["contractid"], $_COOKIE['finished_contracts'])){
-					$x = sizeof($_COOKIE['finished_contracts']);//index for new contract
-					setcookie("finished_contracts[$x]",$_POST["contractid"],time()+60*60*24,'/');
-				}
-			break;
-            case 'isk':
-                if(!isset($_COOKIE['finished_payments'])){
-                    setcookie('finished_payments[0]',$_POST["paymentid"],time()+60*60*24,'/');
-                }elseif (!in_array($_POST["paymentid"], $_COOKIE['finished_payments'])){
-                    $x = sizeof($_COOKIE['finished_payments']);//index for new contract
-                    setcookie("finished_payments[$x]",$_POST["paymentid"],time()+60*60*24,'/');
-                }
-            break;
-    	}
-    }
-
-	print_r(json_encode(array("success"=>true,"return"=>$result)));//setcookie has to be first
+	print_r(json_encode(array("success"=>true,"return"=>$result)));
 } catch (Exception $e) {
 	print_r(json_encode(array("success"=>false,"return"=>'Exception when calling MailApi->postCharactersCharacterIdMail: '+$e->getMessage())));
 }

diff --git a/ajax/set_contracts_finished.php b/ajax/set_contracts_finished.php
@@ -0,0 +1,15 @@
+<?php
+require_once(__DIR__.'/../header.php');
+
+header('Content-Type: application/json;charset=utf-8');
+
+$prev_contracts = isset($_COOKIE['finished_contracts'])?$_COOKIE['finished_contracts']:[];
+
+foreach ($_GET["contractids"] as $contractid){
+	if(!in_array($contractid, $prev_contracts)){
+		$x = sizeof($prev_contracts);//index for new contract
+		array_push($prev_contracts,$contractid);
+		setcookie("finished_contracts[$x]",$contractid,time()+60*60*24,'/');
+	}
+}
+?>
diff --git a/ajax/set_payments_finished.php b/ajax/set_payments_finished.php
@@ -0,0 +1,15 @@
+<?php
+require_once(__DIR__.'/../header.php');
+
+header('Content-Type: application/json;charset=utf-8');
+
+$prev_payments = isset($_COOKIE['finished_payments'])?$_COOKIE['finished_payments']:[];
+
+foreach ($_GET["paymentids"] as $paymentid){
+	if(!in_array($paymentid, $prev_payments)){
+		$x = sizeof($prev_payments);//index for new contract
+		array_push($prev_payments,$paymentid);
+		setcookie("finished_payments[$x]",$paymentid,time()+60*60*24,'/');
+	}
+}
+?>
diff --git a/header.php b/header.php
@@ -6,7 +6,7 @@
 require_once(__DIR__.'/config.php');
 require_once(__DIR__.'/func.php');
 
-$mailer_version = "v1.2.1";
+$mailer_version = "v1.3.0";
 $datasource = "tranquility"; // string | The server name you would like data from
 
 token_refresh();

diff --git a/index.php b/index.php
@@ -120,13 +120,14 @@
 					<table class="table table-bordered table-hover" id="hullsrp-table">
 						<thead>
 						<tr>
-						<th>Contract ID</th><th>Reciever</th><th>Time issued</th><th>Status</th>
+						<th>Contract ID</th><th>Receiver</th><th>Time issued</th><th>Station ID</th><th>Status</th>
 						</tr>
 						</thead>
 						<tbody>
-						<tr id="no_contracts" class="warning"><td colspan=4> No contracts available! </td></tr>
+						<tr id="no_contracts" class="warning"><td colspan=5> No contracts available! </td></tr>
 						</tbody>
 					</table>
+					<span class="help-block">When more than one contract to the same person exists, all contracts will be send in one mail!</span>
 					<button type="button" class="btn btn-primary" id="hull_refresh_button" onclick="hull_table_refresh()">Refresh!</button><br />
 					<span id="contracts-cached-date"></span>
 				</div>';
@@ -135,13 +136,14 @@
 					<table class="table table-bordered table-hover" id="isksrp-table">
 						<thead>
 						<tr>
-						<th>Payment ID</th><th>Reciever</th><th>Time issued</th><th>Reason</th>
+						<th>Payment ID</th><th>Receiver</th><th>Time issued</th><th>Amount(ISK)</th><th>Reason</th>
 						</tr>
 						</thead>
 						<tbody>
-						<tr id="no_payments" class="warning"><td colspan=4> No payments available! </td></tr>
+						<tr id="no_payments" class="warning"><td colspan=5> No payments available! </td></tr>
 						</tbody>
 					</table>
+					<span class="help-block">When more than one payment to the same person exists, all payments will be send in one mail!</span>
 					<button type="button" class="btn btn-primary" id="isk_refresh_button" onclick="isk_table_refresh()">Refresh!</button><br />
 					<span id="payments-cached-date"></span>
 				</div>';