From 6e8674c0532ae909fa7d7dbdb27d533b80689dce Mon Sep 17 00:00:00 2001
From: Andreas Kristiansen <6977712+AndreasK79@users.noreply.github.com>
Date: Mon, 18 Mar 2024 20:45:34 +0100
Subject: [PATCH] Validates visitor link

---
 application/controllers/Stationsetup.php   | 16 +++++++-
 application/models/Stationsetup_model.php  |  6 +--
 application/views/stationsetup/visitor.php |  4 +-
 assets/js/sections/stationsetup.js         | 43 ++++++++++++++--------
 4 files changed, 46 insertions(+), 23 deletions(-)

diff --git a/application/controllers/Stationsetup.php b/application/controllers/Stationsetup.php
index f4a9215f2..43d63321c 100644
--- a/application/controllers/Stationsetup.php
+++ b/application/controllers/Stationsetup.php
@@ -192,8 +192,21 @@ class Stationsetup extends CI_Controller {
 	}
 
 	public function saveVisitorLink() {
+		$name = xss_clean($this->input->post('name', true));
+		$id = xss_clean($this->input->post('id', true));
+
 		$this->load->model('stationsetup_model');
-		$this->stationsetup_model->saveVisitorLink();
+		$result = $this->stationsetup_model->is_public_slug_available($name);
+
+		if($result == true) {
+			$this->stationsetup_model->saveVisitorLink($id, $name);
+			$data['success'] = 1;
+		} else {
+			$data['success'] = 0;
+			$data['flashdata'] = 'Error. Link is already in use!';
+		}
+
+		echo json_encode($data);
 	}
 
 	public function newLocation() {
@@ -408,5 +421,4 @@ class Stationsetup extends CI_Controller {
 		}
 		echo json_encode($data);
 	}
-
 }
diff --git a/application/models/Stationsetup_model.php b/application/models/Stationsetup_model.php
index b778b5170..2bd6955a0 100644
--- a/application/models/Stationsetup_model.php
+++ b/application/models/Stationsetup_model.php
@@ -28,10 +28,10 @@ class Stationsetup_model extends CI_Model {
 		$this->db->update('station_logbooks');
 	}
 
-	function saveVisitorLink() {
-		$this->db->set('public_slug', xss_clean($this->input->post('name', true)));
+	function saveVisitorLink($id, $name) {
+		$this->db->set('public_slug', $name);
 		$this->db->where('user_id', $this->session->userdata('user_id'));
-		$this->db->where('logbook_id', xss_clean($this->input->post('id', true)));
+		$this->db->where('logbook_id', $id);
 		$this->db->update('station_logbooks');
 	}
 
diff --git a/application/views/stationsetup/visitor.php b/application/views/stationsetup/visitor.php
index 2d1ead933..77b04e5a0 100644
--- a/application/views/stationsetup/visitor.php
+++ b/application/views/stationsetup/visitor.php
@@ -2,8 +2,8 @@
 					<p><?php echo lang('station_logbooks_public_slug_hint'); ?></p>
 					<p><?php echo lang('station_logbooks_public_slug_format1')?><br>
 					<?php echo site_url('visitor'); ?>/<?php echo lang('station_logbooks_public_slug_format2'); ?></p>
-					<form hx-post="<?php echo site_url('logbooks/save_publicslug/'); ?>" hx-target="#publicSlugForm" style="display: inline;">
-					<div id="publicSlugForm">
+					<form style="display: inline;">
+					<div id="visitorLinkInfo">
 					</div>
 					<div class="mb-3">
 						<input type="hidden" name="logbook_id" id="logbook_id" value="<?php echo $station_logbook_details->logbook_id; ?>">
diff --git a/assets/js/sections/stationsetup.js b/assets/js/sections/stationsetup.js
index 26482ac7b..b6c646f98 100644
--- a/assets/js/sections/stationsetup.js
+++ b/assets/js/sections/stationsetup.js
@@ -246,8 +246,7 @@ $(document).ready(function () {
 						label: 'Save',
 						cssClass: 'btn-primary btn-sm',
 						action: function (dialogItself) {
-							saveVisitorLink();
-							dialogItself.close();
+							saveVisitorLink(dialogItself);
 						}
 					},
 					{
@@ -267,21 +266,33 @@ $(document).ready(function () {
 		return false;
 	}
 
-	function saveVisitorLink() {
-		$.ajax({
-			url: base_url + 'index.php/stationsetup/saveVisitorLink',
-			type: 'post',
-			data: {
-				id: $('#logbook_id').val(),
-				name: $('#publicSlugInput').val()
-			},
-			success: function (data) {
-				reloadLogbooks();
-			},
-			error: function (data) {
+	function saveVisitorLink(dialogItself) {
+		$('.alert').remove();
+		if (/^([a-zA-Z0-9-]+)$/.test($('#publicSlugInput').val())) {
+			$.ajax({
+				url: base_url + 'index.php/stationsetup/saveVisitorLink',
+				type: 'post',
+				data: {
+					id: $('#logbook_id').val(),
+					name: $('#publicSlugInput').val()
+				},
+				success: function (data) {
+					jdata=JSON.parse(data);
+					if (jdata.success == 1) {
+						dialogItself.close();
+						reloadLogbooks();
+					} else {
+						$('#visitorLinkInfo').append('<div class="alert alert-danger" role="alert">'+jdata.flashdata+'</div>');
+					}
 
-			},
-		});
+				},
+				error: function (data) {
+
+				},
+			});
+		} else {
+			$('#visitorLinkInfo').append('<div class="alert alert-danger" role="alert">Invalid characters entered in link!</div>');
+		}
 		return false;
 	}