&output=html&range=pastYear. * Now: * Generate PDF -> must be logged in, and either a Main Admin or the * student the report is about * short -> same, OR a valid ?key= matching the plugin pref * `stats_key` (for a wall display / client that can't log in) * - removed the dead commented-out code (it's all in git history) * * IMPORTANT: anything that fetches ?mode=short without logging in (a kiosk, * a script) will now get 403 until stats_key is set and the URL has &key=... */ if (!defined('e107_INIT')) { require_once('../../class2.php'); } if (!e107::isInstalled('timekeeper')) { e107::redirect(); exit; } require_once(e_PLUGIN . 'timekeeper/PreHeaderFunctions.php'); /** * May the current visitor see the report for $user? * * @param string $user the ?user= value being requested * @param bool $allowKey also accept the shared ?key= (pref `stats_key`) */ function tk_may_view_reports($user, $allowKey) { if ($allowKey) { $secret = (string) e107::getPlugPref('timekeeper', 'stats_key', ''); $given = filter_input(INPUT_GET, 'key'); if ($secret !== '' && is_string($given) && hash_equals($secret, $given)) { return true; } } if (!USER) { return false; } return check_class('Main Admin') || strcasecmp(e107::getUser()->getLoginName(), $user) === 0; } $mode = filter_input(INPUT_POST, 'mode'); if ($mode == "") { $mode = filter_input(INPUT_GET, 'mode'); } if ($mode == 'Generate PDF' || $mode == 'short') { $reportUser = filter_input(INPUT_GET, 'user'); if (!is_string($reportUser) || !tk_may_view_reports($reportUser, $mode == 'short')) { http_response_code(403); exit('Forbidden'); } if ($mode == 'Generate PDF') { $pdf = new ExcelFunctions; $pdf->GeneratePdf(); } else { $json = new Summary; $json->GenerateSummary(); } } require_once(HEADERF); // render the header (everything before the main content area) require_once(e_PLUGIN . 'timekeeper/TK2.php'); $tk2 = new TK2; $tk2->run(); require_once(FOOTERF); // render the footer (everything after the main content area) exit;