Add openid security
[contractdashboard.git] / lib / common.inc.php
blob:a/lib/common.inc.php -> blob:b/lib/common.inc.php
--- a/lib/common.inc.php
+++ b/lib/common.inc.php
@@ -10,14 +10,20 @@
     die("A database error occurred.\n");

 }

 

-define('ROOT' , pathinfo(__FILE__, PATHINFO_DIRNAME));

-if (strstr($_SERVER['PHP_SELF'], "labs/")) {

+define('ROOT', pathinfo(__FILE__, PATHINFO_DIRNAME));

+if (strstr($_SERVER['PHP_SELF'], "labs/") || strstr($_SERVER['PHP_SELF'], "admin/")) {

     $basePath = "../";

 }

-

-require ROOT . DIRECTORY_SEPARATOR.'..'.DIRECTORY_SEPARATOR.'lib'.DIRECTORY_SEPARATOR.'openid.php';

+require $basePath."lib/amon-php/amon.php";

+Amon::config(array('address'=> 'http://127.0.0.1:2464', 

+		'protocol' => 'http', 

+		'secret_key' => "JBcSUdFOi5lK0vCjLjbHDpQamcBnRA4iV7QLaTADeDQ"));

+Amon::setup_exception_handler();

+

+require ROOT . DIRECTORY_SEPARATOR . '..' . DIRECTORY_SEPARATOR . 'lib' . DIRECTORY_SEPARATOR . 'openid.php';

 $openid = new LightOpenID($_SERVER['HTTP_HOST']);

-

+// you have to open the session to be able to modify or remove it

+session_start();

 function login() {

     global $openid;

     if (!$openid->mode) {

@@ -49,6 +55,7 @@
 function databaseError($errMsg) {

     if ($errMsg[2] != "") {

         echo '<div class="alert-message error">';

+        Amon::log(print_r($errMsg, true).print_r($_REQUEST, true).print_r($_SERVER, true), array('error'));

         die(print_r($errMsg, true));

         echo "</div>";

     }

@@ -100,21 +107,45 @@
 

 $startYear = 2007;

 $year = filter_var($_REQUEST['year'], FILTER_SANITIZE_NUMBER_INT);

-if ($year != "")

+if ($year != "") {

     $yearQ = "YEAR(publishDate) = " . $year . " AND ";

-

+}

 $standardQ = ' "childCN" is null '; // AND YEAR(contractStart) >= 2007 AND YEAR(contractStart) <= 2010';

 $start = 0.0;

+

+function local_url() {

+    return "http://" . $_SERVER['HTTP_HOST'] . rtrim(dirname($_SERVER['PHP_SELF']), '/\\') . "/";

+}

 

 function include_header($title) {

     global $start;

     ?>

-    <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"  

-        "http://www.w3.org/TR/html4/strict.dtd"> 

-    <html>

+    <!DOCTYPE html>

+    <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" version="XHTML+RDFa 1.1"

+       xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"

+       xmlns:rdfs="http://www.w3.org/2000/01/rdf-schema#"

+       xmlns:gr="http://purl.org/goodrelations/v1#"

+       xmlns:dc="http://purl.org/dc/terms/"

+       xmlns:pc="http://purl.org/procurement#"

+       xmlns:unspsc="http://www.ksl.stanford.edu/projects/DAML/UNSPSC.daml#"

+       xmlns:xsd="http://www.w3.org/2001/XMLSchema#"

+       xmlns:pcdt="http://purl.org/procurement/public-contracts-datatypes#"

+        prefix="rdf: http://www.w3.org/1999/02/22-rdf-syntax-ns# 

+              rdfs: http://www.w3.org/2000/01/rdf-schema# 

+              gr: http://purl.org/goodrelations/v1# 

+              dcterms: http://purl.org/dc/terms/ 

+              pc: http://purl.org/procurement/public-contracts# 

+              cpv: http://purl.org/weso/pscs/cpv/2008/resource/ 

+              unspsc: http://www.ksl.stanford.edu/projects/DAML/UNSPSC.daml#

+              v: http://www.w3.org/2006/vcard/ns# 

+              payment: http://reference.data.gov.uk/def/payment# 

+              br: http://purl.org/business-register#              

+              xsd: http://www.w3.org/2001/XMLSchema# 

+              pcdt: http://purl.org/procurement/public-contracts-datatypes#">

         <head>

-            <title>Contract Dashboard - <?php echo $title; ?></title>

+            <title><?php echo $title; ?> - Contract Dashboard</title>

             <link rel="stylesheet" type="text/css" href="bootstrap.min.css"> 

+            <link rel="stylesheet" type="text/css" href="bootstrap-responsive.css"> 

             <!-- Le HTML5 shim, for IE6-8 support of HTML elements -->

             <!--[if lt IE 9]>

               <script src="http://html5shim.googlecode.com/svn/trunk/html5.js"></script>

@@ -146,7 +177,7 @@
                 {  

                     var sValidChars = "0123456789.-,";  

                     var Char;  

-                          

+                                  

                     /* Check the numeric part */  

                     for ( i=1 ; i<sData.length ; i++ )   

                     {   

@@ -156,7 +187,7 @@
                             return null;  

                         }  

                     }  

-                          

+                                  

                     /* Check prefixed by currency */  

                     if ( sData.charAt(0) == '$' || sData.charAt(0) == '£' )  

                     {  

@@ -169,11 +200,11 @@
                     /* Remove any commas (assumes that if present all strings will have a fixed number of d.p) */

                     var x = a == "-" ? 0 : a.replace( /,/g, "" );

                     var y = b == "-" ? 0 : b.replace( /,/g, "" );

-                	

+                        	

                     /* Remove the currency sign */

                     x = x.substring( 1 );

                     y = y.substring( 1 );

-                	

+                        	

                     /* Parse and return */

                     x = parseFloat( x );

                     y = parseFloat( y );

@@ -184,11 +215,11 @@
                     /* Remove any commas (assumes that if present all strings will have a fixed number of d.p) */

                     var x = a == "-" ? 0 : a.replace( /,/g, "" );

                     var y = b == "-" ? 0 : b.replace( /,/g, "" );

-                	

+                        	

                     /* Remove the currency sign */

                     x = x.substring( 1 );

                     y = y.substring( 1 );

-                	

+                        	

                     /* Parse and return */

                     x = parseFloat( x );

                     y = parseFloat( y );

@@ -201,8 +232,8 @@
             <link type="text/css" rel="stylesheet" href="style.css">

         </head>

         <body>

-            <div class="topbar">

-                <div class="topbar-inner">

+            <div class="navbar">

+                <div class="navbar-inner">

                     <div class="container-fluid">

                         <a class="brand" href="#">contract dashboard</a>

                         <ul class="nav">

@@ -218,8 +249,6 @@
                             <li><a href="displayConsultancies.php">consultancies</a></li>

                             <li><a href="displayAmendments.php">amendments</a></li>

                             <li><a href="displayMap.php">geo</a></li>

-                            <!--  </ul>

-                          </li>-->

                         </ul>  

 

 

@@ -233,7 +262,7 @@
             </div><!-- /topbar -->

         </div><!-- /topbar-wrapper -->

         <script type="text/javascript">

-                	

+                        	

             var options_xml = {

                 script: function (input) { return "search_autosuggest.php?input="+input; },

                 varname:"input",

@@ -242,16 +271,14 @@
             var as_xml = new bsn.AutoSuggest('searchKeyword', options_xml);

         </script>

         <div class="container-fluid">

-            <div class="sidebar">

-                <div class="well">

-                    Filter by:<li>

-                    <li>year

-                    <li><li>2008</li>

-                    </li>

-                    </li>

-                    </li> <br>       

-                </div> </div>

-            <div class="content">

+            <div class="row-fluid">

+		<div class="span3">

+                	<div class="well sidebar-nav">

+                    		<li class="nav-header">Filter by:</li>

+                    		<li>2008</li>

+                	</div> 

+		</div>

+            	<div class="span9">

                 <?php

                 $start = (float) array_sum(explode(' ', microtime()));

             }

@@ -260,10 +287,31 @@
                 global $start;

                 $end = (float) array_sum(explode(' ', microtime()));

 

-                echo '  <footer>' . "Processing time: " . sprintf("%.4f", ($end - $start)) . " seconds" . '  <footer>';

+                echo '</div>  <footer>' . "Processing time: " . sprintf("%.4f", ($end - $start)) . " seconds" . '  <footer>';

+

+                    if (strpos($_SERVER['SERVER_NAME'], ".gs")) {

+                    ?>

+                    <script type="text/javascript">

+

+                        var _gaq = _gaq || [];

+                        _gaq.push(['_setAccount', 'UA-12341040-3']);

+                        _gaq.push(['_trackPageview']);

+

+                        (function() {

+                            var ga = document.createElement('script'); ga.type = 'text/javascript'; ga.async = true;

+                            ga.src = ('https:' == document.location.protocol ? 'https://ssl' : 'http://www') + '.google-analytics.com/ga.js';

+                            var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(ga, s);

+                        })();

+

+                    </script>

+                    <?php

+                }

                 echo '</div> </div></body> </html>';

             }

 

             include ("graphs.inc.php");

-            ?>

+

+

+

+