272 lines
12 KiB
Plaintext
272 lines
12 KiB
Plaintext
<%@language = "javascript" %>
|
|
<% /*
|
|
$Revision$
|
|
$Id$
|
|
|
|
File: shorturl.asp
|
|
Description: Redirect naar een bookmark url
|
|
Parameters: u Bookmark die in de bookmark tabel moet zitten.
|
|
Dit moet de eerste parameter zijn als er nog meer komen
|
|
k Een integer keywaarde die plat achter de bookmark_query wordt geplakt
|
|
-- Optionele parameter(s): die worden allemaal blind
|
|
doorgegeven naar het volgende scherm
|
|
Context: Vanuit root
|
|
Note: Welbeschouwd is dit gewoon een url-shortener
|
|
http://sgf12/Facilitor5iWork/?u=J448UIrR43
|
|
Het is verleidelijk de u= parameter ook door te geven maar
|
|
dat is in tegenspraak met het betekenisloos zijn van de u-param
|
|
Als je dat wilt moet je maar BOOKMARK's gebruiken
|
|
*/
|
|
ANONYMOUS_Allowed = 1;
|
|
%>
|
|
<!-- #include file="../Shared/common.inc"-->
|
|
<!-- #include file="../shared/useragent.inc" -->
|
|
|
|
<%
|
|
__Log("== Entering shorturl.asp ==");
|
|
|
|
var u = getQParam("u");
|
|
var known_bookmarks =
|
|
{
|
|
'afspraak': { gui: 'appl/bez/bez_afspraak.asp?afspr_key=', mob: 'appl/pda/afspraak.asp?afs_key=' },
|
|
'bestelling': { gui: 'appl/bes/bes_bestelling.asp?bes_key=', mob: 'appl/pda/bestelling.asp?bes_key=' },
|
|
'bestelopdr': { gui: 'appl/bes/bes_opdr.asp?ordernr=' },
|
|
'contract': { gui: 'appl/cnt/cnt_contract.asp?cnt_key=', mob: 'appl/pda/contract.asp?cnt_key=' },
|
|
/*deprecated*/'deel': { gui: 'appl/ins/ins_deel.asp?ins_key=', mob: 'appl/pda/ins_deel.asp?ins_key=' },
|
|
'object': { gui: 'appl/ins/ins_deel.asp?ins_key=', mob: 'appl/pda/ins_deel.asp?ins_key=' },
|
|
'factuur': { gui: 'appl/fin/fin_factuur.asp?fin_key=', mob: 'appl/pda/factuur.asp?fin_key=' },
|
|
'gebouw': { gui: 'appl/alg/alg_gebouw.asp?key=' },
|
|
'faq': { gui: 'appl/fac/fac_faq.asp?faq_key=' },
|
|
'locatie': { gui: 'appl/alg/alg_locatie.asp?key=' },
|
|
'melding': { gui: 'appl/mld/mld_melding.asp?mld_key=', mob: 'appl/pda/melding.asp?mld_key=' },
|
|
'message': { gui: 'appl/msg/msg_message.asp?message_key=', mob: 'appl/pda/message.asp?msg_key=' },
|
|
'opdracht': { gui: 'appl/mld/mld_opdr.asp?opdr_key=',
|
|
mob: 'appl/pda/order.asp?opdr_key=',
|
|
lckgui: 'appl/mld/mld_opdr_actions.asp?opdr_key=',
|
|
lckmob: 'appl/mld/mld_opdr_actions.asp?opdr_key=' },
|
|
'perslid': { gui: 'appl/prs/prs_perslid.asp?prs_key=', mob: 'appl/pda/user_info.asp?prs_key=' },
|
|
'reservering': { gui: 'appl/res/res_reservering.asp?rsv_ruimte_key=', mob: 'appl/pda/reservering.asp?rsv_ruimte_key=' },
|
|
'ruimte': { gui: 'appl/alg/alg_ruimte.asp?key=', mob: 'appl/pda/ruimte.asp?ruimte_key=' },
|
|
'verdieping': { gui: 'appl/alg/alg_verdieping.asp?key='},
|
|
'xreservering': { gui: 'appl/res/res_reservering.asp?rsv_ruimte_key='}
|
|
}
|
|
|
|
var keyparam = getQParamInt("k", -1);
|
|
|
|
var locked_bdradr_key = getQParamInt("lbdr", -1);
|
|
if (locked_bdradr_key > 0)
|
|
{ // Eerst: hmac controleren
|
|
var sql = "SELECT prs_bedrijfadres_locksecret,"
|
|
+ " prs_bedrijfadres_lockuser_key,"
|
|
+ " prs_bedrijfadres_lockexpire"
|
|
+ " FROM prs_bedrijfadres"
|
|
+ " WHERE prs_bedrijfadres_key = " + locked_bdradr_key
|
|
+ " AND prs_bedrijfadres_locksecret IS NOT NULL"
|
|
+ " AND prs_bedrijfadres_lockuser_key IS NOT NULL";
|
|
var oRs = Oracle.Execute(sql);
|
|
if (oRs.EOF)
|
|
shared.simpel_page("Fixed user for company '{0}' is not or no longer valid.".format(locked_bdradr_key));
|
|
|
|
var locksecret = oRs("prs_bedrijfadres_locksecret").Value;
|
|
var lockuser_key = oRs("prs_bedrijfadres_lockuser_key").Value;
|
|
var lockexpire = oRs("prs_bedrijfadres_lockexpire").Value;
|
|
oRs.Close()
|
|
__Log("Checking locked bdradr {0} expire {1} days".format(locked_bdradr_key, lockexpire));
|
|
protectQS.verify({ sleutel: locksecret,
|
|
expire: lockexpire * 24 * 60,
|
|
checkpath: "/", // altijd tegen de root zonder default.asp
|
|
no_user_key: true }); // tamper check
|
|
|
|
var user_allowed = Session("locked_user_allowed") || []; // Array voor als je meerdere tabjes open hebt
|
|
var found = false;
|
|
for (var i = 0; i < user_allowed.length; i++)
|
|
{
|
|
if (user_allowed[i].locked_user_key == lockuser_key &&
|
|
user_allowed[i].xmlnode == u &&
|
|
user_allowed[i].key == keyparam)
|
|
{
|
|
found = true;
|
|
break;
|
|
}
|
|
}
|
|
if (!found)
|
|
{
|
|
// add linked call as well
|
|
if (u == "opdracht")
|
|
{
|
|
var sql = "SELECT mld_melding_key"
|
|
+ " FROM mld_opdr"
|
|
+ " WHERE mld_opdr_key = " + keyparam;
|
|
var oRs = Oracle.Execute(sql);
|
|
if (!oRs.EOF)
|
|
{
|
|
user_allowed.push({ locked_user_key: lockuser_key,
|
|
xmlnode: "melding",
|
|
key: oRs("mld_melding_key").value
|
|
});
|
|
}
|
|
}
|
|
user_allowed.push({ locked_user_key: lockuser_key,
|
|
xmlnode: u,
|
|
key: keyparam
|
|
})
|
|
Session("locked_user_allowed") = user_allowed;
|
|
}
|
|
}
|
|
|
|
// For flexiblity reasons: Literal or runtime parameter(s), just pass through...
|
|
var rest = String(Request.ServerVariables("QUERY_STRING")); // Request.ServerVariables("QUERY_STRING") is url-encoded,
|
|
// dat is hier safer dan Request.QueryString
|
|
// Strip eventuele leading &fac_id=XXXX er ook af.
|
|
rest = rest.substring(rest.indexOf("u=")).substring(("u="+u).length+1);
|
|
|
|
var isKnownBookmark = false;
|
|
var isMobile = false;
|
|
if (u in known_bookmarks)
|
|
{
|
|
isKnownBookmark = true;
|
|
checkUserAgent(); // devicebits waren anders mogelijk nog niet gezet
|
|
if (Session("interface") == "desktop" || Session("interface") == "touch")
|
|
{
|
|
url = locked_bdradr_key > 0? known_bookmarks[u].lckgui : known_bookmarks[u].gui;
|
|
}
|
|
else
|
|
{
|
|
url = locked_bdradr_key > 0? known_bookmarks[u].lckmob || known_bookmarks[u].lckgui
|
|
: known_bookmarks[u].mob || known_bookmarks[u].gui;
|
|
isMobile = true;
|
|
}
|
|
|
|
url = url + keyparam;
|
|
|
|
if (keyparam > -1)
|
|
{
|
|
rest = rest.substring(("k="+keyparam).length+1);
|
|
}
|
|
if (rest)
|
|
url += "&" + rest;
|
|
}
|
|
else
|
|
{
|
|
var sql = "SELECT fac_bookmark_path,"
|
|
+ " fac_bookmark_query," // Ooit was bedacht dat je de parameters apart in fac_bookmark_query stopt.
|
|
+ " prs_perslid_key_auth," // In de praktijk stoppen mensen het ook vaak in fac_bookmark_path
|
|
+ " fac_bookmark_unauth_url," // Dat kunnen we tegenwoordig (2018.1 Gold C) ook wel aan.
|
|
+ " fac_bookmark_expire,"
|
|
+ " fac_bookmark_refreshtime,"
|
|
+ " fac_bookmark_naam,"
|
|
+ " fac_bookmark_flags"
|
|
+ " FROM fac_bookmark"
|
|
+ " WHERE fac_bookmark_id = " + safe.quoted_sql(u);
|
|
var oRs = Oracle.Execute(sql);
|
|
if (oRs.Eof)
|
|
{
|
|
shared.simpel_page(L("lcl_fac_bookmark_unknown"));
|
|
}
|
|
if (oRs("fac_bookmark_expire").Value != null)
|
|
{
|
|
var expire = new Date(oRs("fac_bookmark_expire").Value);
|
|
if (expire <= new Date)
|
|
{
|
|
shared.simpel_page(L("lcl_fac_bookmark_expired"));
|
|
}
|
|
}
|
|
|
|
var url = oRs("fac_bookmark_path").Value;
|
|
if (url.indexOf("{$*}") > 0) // default.asp?Jumpto=cust/uwva/pacta.asp{$*}
|
|
{
|
|
url = url.replace("{$*}", safe.url("?" + rest));
|
|
rest = "";
|
|
}
|
|
var refresher = oRs("fac_bookmark_refreshtime").Value;
|
|
var bookmark_naam = oRs("fac_bookmark_naam").Value;
|
|
|
|
if (user_key < 0)
|
|
{
|
|
if (oRs("prs_perslid_key_auth").Value)
|
|
{
|
|
var falluser_key = oRs("prs_perslid_key_auth").Value;
|
|
if (bookmark_naam != 'faclikedeeplink' && new Perslid(falluser_key).checkAutorisation("WEB_PRSSYS", true))
|
|
{
|
|
INTERNAL_ERROR_FALLBACK_CANNOT_HAVE_PRSSYS;
|
|
// fac_like_deep.asp staan we wel toe, die heeft een Session.Abandon();
|
|
}
|
|
Session("fallback_user_key") = falluser_key; // wordt opgepikt door loginTry.asp
|
|
}
|
|
else
|
|
Session("unauth_url") = oRs("fac_bookmark_unauth_url").Value; // wordt opgepikt door common.asp
|
|
}
|
|
|
|
var params = oRs("fac_bookmark_query").Value;
|
|
if (params)
|
|
{
|
|
if (keyparam > -1)
|
|
{
|
|
rest = rest.substring(("k="+keyparam).length+1);
|
|
params += keyparam;
|
|
}
|
|
if (rest)
|
|
params += "&" + rest;
|
|
}
|
|
else
|
|
{
|
|
if (rest)
|
|
params = rest;
|
|
}
|
|
|
|
if (params)
|
|
url = url + (url.indexOf('?') > -1?"&":"?") + params;
|
|
|
|
if (oRs("fac_bookmark_flags").Value == 0)
|
|
var url = protectQS.create(url); // prs/pchange_reset.asp, PRS\prs_perslid_qr_confirm.asp en PRS\self_register_confirm.asp verwachten dit
|
|
|
|
oRs.Close();
|
|
}
|
|
|
|
// Als de bookmark een refreshrate heeft ingesteld wordt automatisch gerefreshed
|
|
// We doen een refresh van de complete bookmark, niet alleen van de pagina waar de
|
|
// bookmark naar wijst. Daarmee wordt de fallback_user voor elke refresh opnieuw
|
|
// gebruikt en 'overleeft' de refresh een 'session expired'
|
|
// Voorkom recursie met norefresh
|
|
if (refresher > 0 && getQParamInt("norefresh",0) == 0)
|
|
{
|
|
theURL = "appl/shared/refresher.asp?url=" + Server.URLencode("/?norefresh=1" + transitQS()) + "&refreshrate=" + refresher;
|
|
}
|
|
else
|
|
{
|
|
var theURL = url;
|
|
}
|
|
|
|
if (locked_bdradr_key < 0 && isKnownBookmark && !isMobile && getQParamInt("internal", 0) == 0)
|
|
{
|
|
Session("FirstPage") = theURL;
|
|
theURL = rooturl + "/";
|
|
}
|
|
|
|
var no302 = getQParamInt("no302", 0) == 1;
|
|
// locked_bdradr_key wordt nogal eens vanuit e-mails geopend.
|
|
// Dan wil je ook een gewone redirect (Melding 56152)
|
|
if (no302 || locked_bdradr_key > 0)
|
|
{
|
|
%> <!DOCTYPE html>
|
|
<html>
|
|
<head>
|
|
<title>Facilitor</title>
|
|
<meta http-equiv="refresh" content="0;url=<%=safe.htmlattr(theURL)%>">
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes">
|
|
<style>
|
|
body { font-family:Arial,Helvetica; }
|
|
</style>
|
|
</head>
|
|
<body bgcolor="#ffffff">
|
|
<a href="<%=safe.htmlattr(theURL)%>">Auto redirect</a>
|
|
</body>
|
|
</html>
|
|
<%
|
|
}
|
|
else
|
|
Response.Redirect(theURL);
|
|
%>
|
|
|
|
<% ASPPAGE_END(); %>
|