Files
Facilitor/APPL/CAD/cad_selectbylegend.asp
Jos Groot Lipman 92e0fa1b3c FSN#37620 FALSE-positive SQL-injection en XSS duidelijker maken
svn path=/Website/trunk/; revision=30557
2016-09-05 15:05:58 +00:00

80 lines
2.4 KiB
Plaintext

<%@language = "javascript" %>
<% /*
$Revision$
$Id$
File: cad_selectbylegend.asp
Description: We gaan alle ruimte_keys met die kleur bepalen
Parameters: legenddesc: de aangewezen legenda-tekst
floor: op welke verdieping staat hij (of locatie_key)
(en overige customparameters die we niet gebruiken)
Context: Gebruiker heeft een kleur aangeklikt in de legenda
Result: JSON object
Note: We ondersteunen dit nog alleen maar 'binnen'
*/
JSON_Result = true;
%>
<!-- #include file="../Shared/common.inc" -->
<!-- #include file="../Shared/json2.js" -->
<!-- #include file="../SlnkDWF/SLNK2IMG.inc" -->
<!-- #include file="FGII.inc" -->
<%
var pvKey = getQParamInt("vKey");
var scenario_key = getQParamInt("scenario_key"); // current scenario.
var pThema_key = getQParamInt("thema");
var legenddesc = getQParam("legenddesc");
if (scenario_key == 0)
{
dbTable = "alg_ruimte";
colKey = "alg_ruimte_key";
syncParent = "alg_verdieping_key";
scenFilter = "";
}
else
{
dbTable = "prj_ruimte";
colKey = "prj_ruimte_key";
syncParent = "alg_verdieping_key";
scenFilter = " AND sync.prj_scenario_key = " + scenario_key // En in eigen scenario
}
sql = "SELECT ts.CAD_LEGENDA_KEY,"
+ " tt.CAD_THEMA_VIEW"
+ " FROM CAD_LEGENDA ts, CAD_THEMA tt"
+ " WHERE tt.CAD_THEMA_KEY = " + pThema_key
+ " AND tt.CAD_LEGENDA_KEY = ts.CAD_LEGENDA_KEY"
+ " AND CAD_LEGENDA_DISCREET <> 0";
oRs = Oracle.Execute(sql)
if (oRs.EOF) // Waarschijnlijk CAD_LEGENDA_DISCREET=0
{
Response.Write(JSON.stringify({}));
Response.end;
}
var legenda_key=oRs("CAD_LEGENDA_KEY").value;
var viewName = oRs("CAD_THEMA_VIEW").value;
var sql = "SELECT thema." + colKey
+ " FROM " + dbTable + " SYNC, " + viewName + " thema"
+ " WHERE thema." + colKey + "=sync." + colKey
+ " AND sync." + syncParent + "=" + pvKey
+ " AND thema.waarde = " + safe.quoted_sql(legenddesc)
+ scenFilter;
var keys = [];
var oRs = Oracle.Execute(sql);
while (!oRs.Eof)
{
keys.push(oRs(colKey).Value);
oRs.MoveNext();
}
var result = { success: true, keys: keys }
Response.Write(JSON.stringify(result));
%>