m3 Security Fixes

2026-09-17 10:37:56 +01:00
parent a094477840
commit 1644efed9c
5 changed files with 356 additions and 821 deletions
@@ -42,83 +42,100 @@ class M3ErrorsDispController extends Controller

    public function datatables(Request $request)
    {
-        ini_set('max_execution_time', Config::get('arrays.PHPTimeOut'));
-        ini_set('max_input_time', Config::get('arrays.PHPTimeOut'));
-        ini_set('default_socket_timeout', Config::get('arrays.PHPTimeOut'));
+        $this->configureDataTableRuntime();
+        $filters = $this->dataTableFilters($request);
+        $connection = config('m3.connection', 'pgsql');
+
+        if (! Schema::connection($connection)->hasTable('icm699m')) {
+            return Datatables::of(collect())->addIndexColumn()->make(true);
+        }
+
+        $profile = $this->findM3Profile($connection, $filters['SHUSER']);
+        $query = $this->buildM3LogQuery($connection);
+        $this->applyM3LogFilters($query, $filters, $profile);
+
+        return Datatables::of($query)->addIndexColumn()->make(true);
+    }
+
+    private function configureDataTableRuntime(): void
+    {
+        $timeout = (string) Config::get('arrays.PHPTimeOut');
+        ini_set('max_execution_time', $timeout);
+        ini_set('max_input_time', $timeout);
+        ini_set('default_socket_timeout', $timeout);
        ini_set('memory_limit', '1024M');
+    }

-        // dump($request->all());
-        $SHMACPKR = $request->SHMACPKR != null ? trim($request->SHMACPKR) : '';
-        $SHSOURCE = $request->SHSOURCE != null ? trim($request->SHSOURCE) : '';
-        $STARTDATE = $request->STARTDATE != null ? trim($request->STARTDATE) : today()->subDays(1)->format('Y-m-d');
-        $ENDDATE = $request->ENDDATE != null ? trim($request->ENDDATE) : today()->format('Y-m-d');
-        $SHOWERRORS = $request->SHOWERRORS != null ? trim($request->SHOWERRORS) : 'N';
-        $SHUSER = m3_user() !== '' ? Str::upper(trim(m3_user())) : '';
-        $SKIPDATES = $request->SKIPDATES != null ? trim($request->SKIPDATES) : 'N';
+    private function dataTableFilters(Request $request): array
+    {
+        return [
+            'SHMACPKR' => trim((string) $request->input('SHMACPKR', '')),
+            'SHSOURCE' => trim((string) $request->input('SHSOURCE', '')),
+            'STARTDATE' => trim((string) $request->input('STARTDATE', today()->subDays(1)->format('Y-m-d'))),
+            'ENDDATE' => trim((string) $request->input('ENDDATE', today()->format('Y-m-d'))),
+            'SHOWERRORS' => trim((string) $request->input('SHOWERRORS', 'N')),
+            'SHUSER' => m3_user() !== '' ? Str::upper(trim(m3_user())) : '',
+            'SKIPDATES' => trim((string) $request->input('SKIPDATES', 'N')),
+        ];
+    }

-        // Get Logged User CO & WH
-        // Get users from ICM428M
-        $ICM428M = DB::connection(config('m3.connection', 'pgsql'))->table('icm428m')
+    private function findM3Profile(string $connection, string $user): ?object
+    {
+        if ($user === '' || ! Schema::connection($connection)->hasTable('icm428m')) {
+            return null;
+        }
+
+        return DB::connection($connection)->table('icm428m')
            ->select('R428US', 'R428CO', 'R428WH')
-            ->where('R428US', '=', $SHUSER)
+            ->where('R428US', $user)
            ->first();
+    }

-        $R428US = isset($ICM428M->R428US) ? $ICM428M->R428US : '';
-        $USERCO = isset($ICM428M->R428CO) ? $ICM428M->R428CO : '';
-        $USERWH = isset($ICM428M->R428WH) ? $ICM428M->R428WH : '';
+    private function buildM3LogQuery(string $connection)
+    {
+        $query = DB::connection($connection)->table('icm699m')
+            ->select('ICM699M.*', DB::raw("ICM699M.SHDT || ' ' || ICM699M.SHTIME AS SHDATETIME"))
+            ->distinct();

-        // Merge date and time fields
-        $mergedDateTime = DB::raw(" ICM699M.SHDT || ' ' || ICM699M.SHTIME AS SHDATETIME");
+        if (Schema::connection($connection)->hasTable('icm428m')) {
+            $query->addSelect('ICM428M.R428FIRST', 'ICM428M.R428FAMILY')
+                ->leftJoin('ICM428M', 'ICM699M.SHUSER', '=', 'ICM428M.R428US');
+        }
+        if (Schema::connection($connection)->hasTable('icm688m1')) {
+            $query->addSelect('ICM688M1.A4ONO', 'ICM688M1.A4SHSHNM')
+                ->leftJoin('ICM688M1', 'ICM699M.SHMACPKR', '=', 'ICM688M1.A4MACPKR');
+        }
+        if (Schema::connection($connection)->hasTable('icm666m')) {
+            $query->addSelect('ICM666M.A1ONO', 'ICM666M.A1SHSHNM')
+                ->leftJoin('ICM666M', 'ICM699M.SHMACPKR', '=', 'ICM666M.A1DELNO');
+        }

-        $ICM699M = DB::connection(config('m3.connection', 'pgsql'))->table('icm699m')
-            ->select(
-                'ICM699M.*',
-                'ICM699M.SHACKDATE',
-                'ICM699M.SHACKTIME',
-                'ICM699M.SHACKUSER',
-                $mergedDateTime,
-                'ICM428M.R428FIRST',
-                'ICM428M.R428FAMILY',
-                'ICM688M1.A4ONO',
-                'ICM688M1.A4SHSHNM',
-                'ICM666M.A1ONO',
-                'ICM666M.A1SHSHNM',
-            )
-            ->distinct()
-            ->leftJoin('ICM428M', 'ICM699M.SHUSER', '=', 'ICM428M.R428US')
-            ->leftJoin('ICM688M1', 'ICM699M.SHMACPKR', '=', 'ICM688M1.A4MACPKR')
-            ->leftJoin('ICM666M', 'ICM699M.SHMACPKR', '=', 'ICM666M.A1DELNO');
+        return $query;
+    }

-        if ($R428US != '') {
-            $ICM699M->whereIn('SHCO', [$USERCO, '']);
-            $ICM699M->whereIn('SHWHS', [$USERWH, '']);
+    private function applyM3LogFilters($query, array $filters, ?object $profile): void
+    {
+        if ($profile !== null) {
+            $query->whereIn('SHCO', [trim((string) ($profile->R428CO ?? '')), ''])
+                ->whereIn('SHWHS', [trim((string) ($profile->R428WH ?? '')), '']);
        } else {
-            $ICM699M->where('SHCO', null);
-            $ICM699M->where('SHWHS', null);
+            $query->whereNull('SHCO')->whereNull('SHWHS');
        }

-        if ($SHMACPKR != '') {
-            $ICM699M->where('SHMACPKR', $SHMACPKR);
+        foreach (['SHMACPKR', 'SHSOURCE'] as $field) {
+            if ($filters[$field] !== '') {
+                $query->where($field, $filters[$field]);
+            }
        }

-        if ($SHSOURCE != '') {
-            $ICM699M->where('SHSOURCE', $SHSOURCE);
+        $query->where('SHSOURCE', '!=', 'PdfStorageAPI');
+        if ($filters['SHMACPKR'] === '' && $filters['SKIPDATES'] === 'N') {
+            $query->whereBetween('SHDT', [$filters['STARTDATE'], $filters['ENDDATE']]);
        }
-        // Disable PDFStorage Search
-        $ICM699M->where('SHSOURCE', '!=', 'PdfStorageAPI');
-
-        if ($SHMACPKR == '' && $SKIPDATES == 'N') {
-            $ICM699M->whereBetween('SHDT', [$STARTDATE, $ENDDATE]);
+        if ($filters['SHOWERRORS'] === 'Y') {
+            $query->where('SHERROR', 'X');
        }
-
-        if ($SHOWERRORS == 'Y') {
-            $ICM699M->where('SHERROR', 'X');
-        }
-
-        // Get only M3 Logs
-        $ICM699M->where('SHTYPE', 'like', '%M3%');
-
-        return Datatables::of($ICM699M)->addIndexColumn()->make(true);
+        $query->where('SHTYPE', 'like', '%M3%');
    }

    public static function update699M(Request $request)