Fixed issue-1 bug Fixed bug where prompt to set flags on reference chain was displayed even when no flags were available.

Added License info for the Fugue icon set

CHANGELOG

@@ -278,3 +278,7 @@
         installation.
     - Various code cleanups to prevent php warnings in the logs if logging
         is enabled.
+    - Validate all date and time fields to prevent user entered invalid date
+        formats from crashing php.
+    - Fixed profile page to automatically refresh page to show the results 
+        when a user changes their color preferences.

INSTALL

@@ -4,7 +4,6 @@
 
     SPDX-License-Identifier: GPL-2.0
 
-
 Installation of OpenLog is straightforward.
 
 1. Gather the required information.
@@ -31,5 +30,4 @@ settings. You will need to log in as OpenLogAdmin. The initial default password
    is "OpenLog-1". From the Administration page, you can click on the links at the
    top to add techs, subjects, shifts, etc.
 
-7. Start using OpenLog.
-
+6. Start using OpenLog.

database-initial.sql

@@ -122,7 +122,7 @@ set autocommit = 0;
 
 INSERT INTO
     `configs`
-VALUES (1, 'ol_version', '5.2.4'),
+VALUES (1, 'ol_version', '5.3.0'),
     (2, 'log_name', 'OpenLog'),
     (3, 'banner', '1'),
     (

default-apache.conf

@@ -0,0 +1,13 @@
+# _APPNAME_ default Apache configuration
+
+Alias /_BASEURL_ _DOCROOTIN_/_BASEURL_
+
+<Directory _DOCROOTIN_/_BASEURL_>
+    AllowOverride Options
+    Options FollowSymLinks
+    DirectoryIndex index.php
+
+    #RewriteEngine On
+    #RewriteBase /_BASEURL_/
+    #RewriteRule . maintenancemode.php [L]
+</Directory>

distfiles/CHANGELOG

@@ -278,3 +278,9 @@
         installation.
     - Various code cleanups to prevent php warnings in the logs if logging
         is enabled.
+    - Validate all date and time fields to prevent user entered invalid date
+        formats from crashing php.
+    - Fixed profile page to automatically refresh page to show the results 
+        when a user changes their color preferences.
+
+    

distfiles/admin.php

@@ -764,6 +764,7 @@ switch ($table) {
                 ";
                 // pull current values from database
                 $currentvalues = mysqli_fetch_assoc(mysqli_query($db, "select * from techs where techid=$id"));
+                if (!empty($currentvalues)) {
                     $name = $currentvalues["techname"];
                     $pass = $passconf = "password_is_unchanged";
                     $shift = $currentvalues["shift"];
@@ -777,6 +778,13 @@ switch ($table) {
                     } else {
                         $activetag = "<input type=\"checkbox\" name=\"active\">";
                     }
+                } else {
+                    $name = NULL;
+                    $pass = NULL;
+                    $shift = NULL;
+                    $admintag = "<input type=\"checkbox\" name=\"admin\">";
+                    $activetag = "<input type=\"checkbox\" name=\"active\">";
+                }
             } else {
                 // set form options for add
                 $sectiontitle = "<b>Add New Tech</b><br><br>";
@@ -878,12 +886,17 @@ switch ($table) {
                 ";
                 // pull current values from database
                 $currentvalues = mysqli_fetch_assoc(mysqli_query($db, "select * from shifts where shiftid=$id"));
+                if (!empty($currentvalues)) {
                     $name = $currentvalues["shiftname"];
                     if ($currentvalues["status"] == 1) {
                         $activetag = "<input type=\"checkbox\" name=\"active\" checked>";
                     } else {
                         $activetag = "<input type=\"checkbox\" name=\"active\">";
                     }
+                } else {
+                    $name = NULL;
+                    $activetag = "<input type=\"checkbox\" name=\"active\">";
+                }
             } else {
                 // set form options for add
                 $sectiontitle = "<b>Add New Shift</b><br><br>";
@@ -952,12 +965,17 @@ switch ($table) {
                 ";
                 // pull current values from database
                 $currentvalues = mysqli_fetch_assoc(mysqli_query($db, "select * from subjects where subjectid=$id"));
+                if (!empty($currentvalues)) {
                     $name = $currentvalues["subjectname"];
                     if ($currentvalues["status"] == 1) {
                         $activetag = "<input type=\"checkbox\" name=\"active\" checked>";
                     } else {
                         $activetag = "<input type=\"checkbox\" name=\"active\">";
                     }
+                } else {
+                    $name = "";
+                    $activetag = "<input type=\"checkbox\" name=\"active\">";
+                }
             } else {
                 // set form options for add
                 $sectiontitle = "<b>Add New Subject</b><br><br>";
@@ -1026,6 +1044,7 @@ switch ($table) {
                 ";
                 // pull current values from database
                 $currentvalues = mysqli_fetch_assoc(mysqli_query($db, "select * from links where linkid=$id"));
+                if (!empty($currentvalues)) {
                     $name = $currentvalues["displaytxt"];
                     $priority = $currentvalues["linkpriority"];
                     $url = $currentvalues["urltxt"];
@@ -1034,6 +1053,12 @@ switch ($table) {
                     } else {
                         $activetag = "<input type=\"checkbox\" name=\"active\">";
                     }
+                } else {
+                    $name = NULL;
+                    $priority = NULL;
+                    $url = NULL;
+                    $activetag = "<input type=\"checkbox\" name=\"active\">";
+                }
                 // determine where we are in the priority stack
                 $prow = mysqli_fetch_assoc(mysqli_query($db, "select min(linkpriority) as highest from links"));
                 if ($prow["highest"] == $priority) {
@@ -1145,10 +1170,22 @@ switch ($table) {
                 ";
                 // pull current values from database
                 $currentvalues = mysqli_fetch_assoc(mysqli_query($db, "select * from flags where flagid=$id"));
+                if (!empty($currentvalues)) {
                     $name = $currentvalues["flagname"];
                     $flagsym = $currentvalues["flagsym"];
                     $flagcolor = $currentvalues["flagcolor"];
                     $flagcoloropts = "";
+                    if ($currentvalues["status"] == 1) {
+                        $activetag = "<input type=\"checkbox\" name=\"active\" checked>";
+                    } else {
+                        $activetag = "<input type=\"checkbox\" name=\"active\">";
+                    }
+                } else {
+                    $name = NULL;
+                    $flagsym = NULL;
+                    $flagcolor = NULL;
+                    $activetag = "<input type=\"checkbox\" name=\"active\">";
+                }
                 foreach ($basic_colors as $cname => $chex) {
                     if ($chex == $flagcolor) {
                         $flagcoloropts = $flagcoloropts . "<option value=\"$chex\" selected>$cname</option>";
@@ -1156,11 +1193,6 @@ switch ($table) {
                         $flagcoloropts = $flagcoloropts . "<option value=\"$chex\">$cname</option>";
                     }
                 }
-                if ($currentvalues["status"] == 1) {
-                    $activetag = "<input type=\"checkbox\" name=\"active\" checked>";
-                } else {
-                    $activetag = "<input type=\"checkbox\" name=\"active\">";
-                }
             } else {
                 // set form options for add
                 $sectiontitle = "<b>Add New Flag</b><br><br>";
@@ -1246,12 +1278,17 @@ switch ($table) {
                 ";
                 // pull current values from database
                 $currentvalues = mysqli_fetch_assoc(mysqli_query($db, "select * from logpartactions where lpactionid=$id"));
+                if (!empty($currentvalues)) {
                     $name = $currentvalues["lpactionname"];
                     if ($currentvalues["status"] == 1) {
                         $activetag = "<input type=\"checkbox\" name=\"active\" checked>";
                     } else {
                         $activetag = "<input type=\"checkbox\" name=\"active\">";
                     }
+                } else {
+                    $name = NULL;
+                    $activetag = "<input type=\"checkbox\" name=\"active\">";
+                }
             } else {
                 // set form options for add
                 $sectiontitle = "<b>Add New Part Action</b><br><br>";
@@ -1320,9 +1357,15 @@ switch ($table) {
                 ";
                 // pull current values from database
                 $currentvalues = mysqli_fetch_assoc(mysqli_query($db, "select * from banners where bannerid=$id"));
+                if (!empty($currentvalues)) {
                     $name = $currentvalues["bannername"];
                     $bnrcolor = $currentvalues["bannercolor"];
                     $bnrtextcolor = $currentvalues["textcolor"];
+                } else {
+                    $name = NULL;
+                    $bnrcolor = NULL;
+                    $bnrtextcolor = NULL;
+                }
                 $bnrcoloropts = "";
                 foreach ($basic_colors as $cname => $chex) {
                     if ($chex == $bnrcolor) {

distfiles/functions.php

@@ -953,8 +953,9 @@ function templateselect($techid, $operation)
 {
     // Displays a line enabling selection of a user or global template
     // $techid is the id number of the current tech
-    // $operation is one of "add" "edit" "delete"
+    // $operation is one of "add" "edit" "delete" or NULL
     global $db;
+    $isadmin = dblookup($db, "techs", "techid", "admin", $techid);
     echo "
     <form method=\"post\">
     ";
@@ -967,11 +968,20 @@ function templateselect($techid, $operation)
     <td>
     <select name=\"usertemplateid\" title=\"Select the user template you'd like to load and click the Load Template button. User template selection takes precedence.\">
     ";
+    if ($isadmin && $operation != NULL) {
+        $templaterow = mysqli_query($db, "select * from notetemplates where tech!=\"0\" order by tech asc, templatename asc");
+    } else {
         $templaterow = mysqli_query($db, "select * from notetemplates where tech=\"$techid\" order by templatename asc");
+    }
     printf("<option value=\"%s\" selected>%s</option>", "0", "Select user template");
     while ($templateitem = mysqli_fetch_assoc($templaterow)) {
+        if ($isadmin && $operation != NULL) {
+            $techname = dblookup($db, "techs", "techid", "techname", $templateitem["tech"]);
+            printf("<option value=\"%s\">%s(%s)</option>", $templateitem["templateid"], $templateitem["templatename"], $techname);
+        } else {
             printf("<option value=\"%s\">%s</option>", $templateitem["templateid"], $templateitem["templatename"]);
         }
+    }
     echo "
     </select>&nbsp;or&nbsp;
     ";
@@ -1000,3 +1010,31 @@ function templateselect($techid, $operation)
     </form>
     ";
 }
+
+function fix_date($datestring)
+{
+    // accepts a string as an argument
+    // returns a valid date string in the format YYYY-MM-DD
+    // if input string is not a valid date, return the current date
+    global $db, $today;
+
+    if (!$datestring) $datestring = $today;
+    $datepatt = '/^\d{4}-(?:0[1-9]|1[0-2])-(?:0[1-9]|[12]\d|3[01])$/';
+    if (!preg_match($datepatt, $datestring)) $datestring = $today;
+    $datestring = mysqli_real_escape_string($db, $datestring);
+    return $datestring;
+}
+
+function fix_time($timestring)
+{
+    // accepts a string as an argument
+    // returns a valid time string in the format HH:MM:SS
+    // if input string is not a valid time, return the current time
+    global $db, $now;
+
+    if (!$timestring) $timestring = $now;
+    $timepatt = '/^([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]$/';
+    if (!preg_match($timepatt, $timestring)) $timestring = $now;
+    $timestring = mysqli_real_escape_string($db, $timestring);
+    return $timestring;
+}

distfiles/logentry.php

@@ -9,7 +9,7 @@
 
 include("functions.php");
 
-if (!$_SESSION['login'] && !$_REQUEST['partview']) {
+if (!array_key_exists("login", $_SESSION) && !array_key_exists("partview", $_REQUEST)) {
     header("Location: login.php");
 }
 
@@ -40,7 +40,7 @@ $uids = $_POST['uids'] ?? [];
 $partnums = $_POST['partnums'] ?? [];
 $sernums = $_POST['sernums'] ?? [];
 $actions = $_POST['actions'] ?? [];
-$mfreqs = $_POST['mfreqs'] ?? [];
+$mfreqs = $_POST['mfreqs'] ?? ["off"];
 $schedmaintcomplete = $_REQUEST['schedmaintcomplete'] ?? NULL;
 $partview = $_REQUEST['partview'] ?? NULL;
 
@@ -96,10 +96,9 @@ if ($add) {
         // add the entry if submit is pressed   
         if ($note) {
             // sanitize and fix blank date and time
-            $date = mysqli_real_escape_string($db, $date);
-            $time = mysqli_real_escape_string($db, $time);
-            if (!$date) $date = $today;
-            if (!$time) $time = $now;
+            $date = fix_date($date);
+            $time = fix_time($time);
+
             // determine whether supplied date is future or past
             $datediff = mysqli_fetch_row(mysqli_query($db, "select datediff(\"$date\",CURRENT_DATE)"));
             // if future, set time to 00:00:01, if past, set to 23:59:59
@@ -200,7 +199,7 @@ if ($add) {
                             // add it to logparts table
                             mysqli_query($db, "insert into logparts(lognoteid,partid,action) values(\"$newnoteid\",\"$lpid\",\"$actions[$plidx]\")");
                             // create a maintenance form if required
-                            if ($mfreqs[$plidx] == "on") {
+                            if (array_key_exists($plidx,$mfreqs) && $mfreqs[$plidx] == "on") {
                                 mysqli_query($db, "insert into maintforms(mfdate,mftech,mfpart,pending,lognoteid) values(\"$date\",\"$techid\",\"$lpid\",1,\"$newnoteid\")");
                             }
 
@@ -218,7 +217,7 @@ if ($add) {
                             // add it to logparts table
                             mysqli_query($db, "insert into logparts(lognoteid,partid,action) values(\"$newnoteid\",\"$lpid\",\"$actions[$plidx]\")");
                             // create a maintenance form if required
-                            if ($mfreqs[$plidx] == "on") {
+                            if (array_key_exists($plidx,$mfreqs) && $mfreqs[$plidx] == "on") {
                                 mysqli_query($db, "insert into maintforms(mfdate,mftech,mfpart,pending,lognoteid) values(\"$date\",\"$techid\",\"$lpid\",1,\"$newnoteid\")");
                             }
 
@@ -236,7 +235,7 @@ if ($add) {
                             // add it to logparts table
                             mysqli_query($db, "insert into logparts(lognoteid,partid,action) values(\"$newnoteid\",\"$lpid\",\"$actions[$plidx]\")");
                             // create a maintenance form if required
-                            if ($mfreqs[$plidx] == "on") {
+                            if (array_key_exists($plidx,$mfreqs) && $mfreqs[$plidx] == "on") {
                                 mysqli_query($db, "insert into maintforms(mfdate,mftech,mfpart,pending,lognoteid) values(\"$date\",\"$techid\",\"$lpid\",1,\"$newnoteid\")");
                             }
                         } else {
@@ -263,6 +262,10 @@ if ($edit) {
     if ($removepart && $authorized) mysqli_query($db, "delete from logparts where lognoteid=\"$noteid\" and logpartid=\"$removepart\"");
     if ($submit) {
         if ($note) {
+            // sanitize and fix blank date and time
+            $date = fix_date($date);
+            $time = fix_time($time);
+
             // remove cruft from note text
             $note = strip_tags($note, "<a>");
             $note = mysqli_real_escape_string($db, $note);
@@ -361,7 +364,7 @@ if ($edit) {
                             // add it to logparts table
                             mysqli_query($db, "insert into logparts(lognoteid,partid,action) values(\"$noteid\",\"$lpid\",\"$actions[$plidx]\")");
                             // create a maintenance form if required
-                            if ($mfreqs[$plidx] == "on") {
+                            if (array_key_exists($plidx,$mfreqs) && $mfreqs[$plidx] == "on") {
                                 mysqli_query($db, "insert into maintforms(mfdate,mftech,mfpart,pending,lognoteid) values(\"$date\",\"$techid\",\"$lpid\",1,\"$noteid\")");
                             }
 
@@ -379,7 +382,7 @@ if ($edit) {
                             // add it to logparts table
                             mysqli_query($db, "insert into logparts(lognoteid,partid,action) values(\"$noteid\",\"$lpid\",\"$actions[$plidx]\")");
                             // create a maintenance form if required
-                            if ($mfreqs[$plidx] == "on") {
+                            if (array_key_exists($plidx,$mfreqs) && $mfreqs[$plidx] == "on") {
                                 mysqli_query($db, "insert into maintforms(mfdate,mftech,mfpart,pending,lognoteid) values(\"$date\",\"$techid\",\"$lpid\",1,\"$noteid\")");
                             }
 
@@ -397,7 +400,7 @@ if ($edit) {
                             // add it to logparts table
                             mysqli_query($db, "insert into logparts(lognoteid,partid,action) values(\"$noteid\",\"$lpid\",\"$actions[$plidx]\")");
                             // create a maintenance form if required
-                            if ($mfreqs[$plidx] == "on") {
+                            if (array_key_exists($plidx,$mfreqs) && $mfreqs[$plidx] == "on") {
                                 mysqli_query($db, "insert into maintforms(mfdate,mftech,mfpart,pending,lognoteid) values(\"$date\",\"$techid\",\"$lpid\",1,\"$noteid\")");
                             }
                         } else {
@@ -497,7 +500,7 @@ if ($delete) {
     format_message(0, "<strong>Note deleted.</strong> <a href=\"lognotes.php\">Return to main page.</a>");
 }
 
-if ($_SESSION['login']) {
+if (array_key_exists('login', $_SESSION)) {
     // show the template selection line
     templateselect($techid, NULL);
 }
@@ -616,7 +619,6 @@ $flagcount = 1;
 
 // display checkboxes for all the flags, selecting the ones that are set for this note/template
 while ($flagcheckbox = mysqli_fetch_assoc($flagslist)) {
-
     if (in_array($flagcheckbox["flagid"], $theseflags)) {
         printf(
             "<input type=\"checkbox\" name=\"flags[]\" value=\"%s\" checked><font color=\"%s\" title=\"%s\">%s</font>",
@@ -645,9 +647,15 @@ while ($flagcheckbox = mysqli_fetch_assoc($flagslist)) {
         $flagcount = 1;
     }
 }
+if (mysqli_num_rows($flagslist)) {
     echo "
     <br><input type=\"checkbox\" name=\"syncflags\" value=\"1\"><font title=\"Set the selected flags on the other notes in the reference chain\">Set flags on reference chain</font>
     ";
+} else {
+    echo "
+    <input type=\"hidden\" name=\"syncflags\" value=\"0\">
+    ";
+}
 
 if ($add && $refto) $refstring = $refto;
 echo "
@@ -675,18 +683,14 @@ if ($add) {
             <td align=\"center\"><input type=\"text\" name=\"partnums[$partline]\" size=\"20\"></td>
             <td align=\"center\"><input type=\"text\" name=\"sernums[$partline]\" size=\"20\"></td>
             <td align=\"center\"><select name=\"actions[$partline]\">
-            <option value=\"select\">Select Action</option>
+            <option value=\"$defaultaction\" selected>Select Action</option>
             ";
             $actrow = mysqli_query($db, "select * from logpartactions");
             while ($actitem = mysqli_fetch_assoc($actrow)) {
                 if ($actitem["status"] == 1) {
-                    if ($actitem["lpactionid"] == $defaultaction) {
-                        printf("<option value=\"%s\" selected>%s</option>", $actitem["lpactionid"], $actitem["lpactionname"]);
-                    } else {
                     printf("<option value=\"%s\">%s</option>", $actitem["lpactionid"], $actitem["lpactionname"]);
                 }
             }
-            }
             echo "
             </select>
             </td>
@@ -736,19 +740,28 @@ if ($edit) {
             <td align=\"center\">$epsn</td>
             <td align=\"center\">
             ";
-            $actrow = mysqli_query($db, "select * from logpartactions");
-            while ($actitem = mysqli_fetch_assoc($actrow)) {
-                if ($actitem["lpactionid"] == $defaultaction) {
-                    echo "$actitem[lpactionname]";
-                }
+            if ($defaultaction) {
+                // an action was selected previously, so just display it
+                $actname = dblookup($db, "logpartactions", "lpactionid", "lpactionname", $defaultaction);
+                echo "$actname";
             }
             echo "
             </td>
             ";
             // find maint form for this line and show link
-            $mflinknum = mysqli_fetch_assoc(mysqli_query($db, "select maintformid from maintforms where lognoteid=\"$noteid\" and mfpart=\"$lpidvar\""))["maintformid"];
             echo "
-            <td align=\"center\"><a href=\"maintformentry.php?mfedit=1&maintformid=$mflinknum\" title=\"Click to view/edit this maintenance form\">$mflinknum</a></td>
+            <td align=\"center\">
+            ";
+            $mflinkqry = mysqli_query($db, "select maintformid from maintforms where lognoteid=\"$noteid\" and mfpart=\"$lpidvar\"");
+            if (mysqli_num_rows($mflinkqry)) {
+                $mflinkdata = mysqli_fetch_assoc($mflinkqry);
+                $mflinknum = $mflinkdata["maintformid"];
+                echo "
+                <a href=\"maintformentry.php?mfedit=1&maintformid=$mflinknum\" title=\"Click to view/edit this maintenance form\">$mflinknum</a>
+                ";
+            }
+            echo "
+            </td>
             </tr>
             ";
         }
@@ -761,18 +774,14 @@ if ($edit) {
             <td align=\"center\"><input type=\"text\" name=\"partnums[$partline]\" size=\"20\"></td>
             <td align=\"center\"><input type=\"text\" name=\"sernums[$partline]\" size=\"20\"></td>
             <td align=\"center\"><select name=\"actions[$partline]\">
-            <option value=\"select\">Select Action</option>
+            <option value=\"$defaultaction\" selected>Select Action</option>
             ";
             $actrow = mysqli_query($db, "select * from logpartactions");
             while ($actitem = mysqli_fetch_assoc($actrow)) {
                 if ($actitem["status"] == 1) {
-                    if ($actitem["lpactionid"] == $defaultaction) {
-                        printf("<option value=\"%s\" selected>%s</option>", $actitem["lpactionid"], $actitem["lpactionname"]);
-                    } else {
                     printf("<option value=\"%s\">%s</option>", $actitem["lpactionid"], $actitem["lpactionname"]);
                 }
             }
-            }
             echo "
             </select>
             </td>

distfiles/login.php

@@ -9,11 +9,11 @@
 
 include("functions.php");
 
-$print = $_REQUEST['print'];
-$tech = $_REQUEST['tech'];
-$pass = $_REQUEST['pass'];
-$login = $_REQUEST['login'];
-$cancel = $_REQUEST['cancel'];
+$print = $_REQUEST['print'] ?? NULL;
+$tech = $_REQUEST['tech'] ?? NULL;
+$pass = $_REQUEST['pass'] ?? NULL;
+$login = $_REQUEST['login'] ?? NULL;
+$cancel = $_REQUEST['cancel'] ?? NULL;
 
 if ($cancel) {
     session_destroy();

distfiles/maintformentry.php

@@ -135,6 +135,9 @@ if ($mfadd) {
     if ($mfsubmit) {
         // add the entry if submit is pressed
         if ($mfmalfunction && ($uid || ($partnum && $sernum))) {
+            // sanitize and fix blank date and time
+            $mfdate = fix_date($mfdate);
+            $mftime = fix_time($mftime);
             // determine whether supplied date is future or past
             $datediff = mysqli_fetch_row(mysqli_query($db, "select datediff(\"$mfdate\",CURRENT_DATE)"));
             // if future, set time to 00:00:01, if past, set to 23:59:59
@@ -175,6 +178,7 @@ if ($mfadd) {
 
                 // add the record to maintforms
                 if (! $pdatamismatch) {
+                    $lognoteid = ($lognoteid == NULL) ? 0 : $lognoteid;
                     mysqli_query($db, "insert into maintforms(mfdate,mftime,mftech,mfpart,mfpartloc,mfmalfunction,nha,repord,lognoteid,pending)
                      values (\"$mfdate\", \"$mftime\",\"$loggedinas\",\"$mfpart\",\"$mfpartloc\",\"$mfmalfunction\",\"$nha\",\"$repord\",\"$lognoteid\",\"$pending\")");
                     $newmaintformid = mysqli_insert_id($db);
@@ -183,7 +187,7 @@ if ($mfadd) {
                     // update the flagmap table
                     foreach ($flags as $thisflag) {
                         // set flag for this maintenance form
-                        mysqli_query($db, "insert into flagmap(flagid,maintformid) values(\"$thisflag\",\"$$newmaintformid\")");
+                        mysqli_query($db, "insert into flagmap(flagid,maintformid) values(\"$thisflag\",\"$newmaintformid\")");
                     }
                 }
             }
@@ -236,6 +240,9 @@ if ($mfdelete && $mfauthorized) {
 if ($actionadd) {
     if ($actionaddsubmit) {
         if ($action) {
+            // sanitize and fix blank date and time
+            $actiondate = fix_date($actiondate);
+            $actiontime = fix_time($actiontime);
             // determine whether supplied date is future or past
             $datediff = mysqli_fetch_row(mysqli_query($db, "select datediff(\"$actiondate\",CURRENT_DATE)"));
             // if future, set time to 00:00:01, if past, set to 23:59:59
@@ -260,6 +267,9 @@ if ($actionadd) {
 if ($actionedit) {
     if ($actioneditsubmit && $actionauthorized) {
         // update the action
+        // sanitize and fix blank date and time
+        $actiondate = fix_date($actiondate);
+        $actiontime = fix_time($actiontime);
         // remove cruft from action text
         $action = htmlentities($action);
         $action = addslashes($action);

distfiles/profile.php

@@ -116,6 +116,8 @@ if (!$print) {
         // color settings
         $hexcolor = "#" . ltrim($hexcolor);
         putsetting($modcolor, $hexcolor, $techid);
+        $currentpage = $_SERVER['PHP_SELF'];
+        header("Refresh: .1; url=$currentpage");
     }
     if ($resetcustom) mysqli_query($db, "delete from customs where customtech=\"$techid\"");
 

distfiles/schedmaint.php

@@ -1,6 +1,6 @@
 <?php
 /*
-    blankpage.php
+    schedmaint.php
     OpenLog Online Logbook
     Copyright (C) 2026  Rod Wright
 
@@ -73,9 +73,9 @@ $errorstack = array();
 if ($action) {
     if ($complete) {
         // sanitize user input
-        $completedate = mysqli_real_escape_string($db, $completedate);
+        $completedate = fix_date($completedate);
         // update events
-        mysqli_query($db, "update events set last_date=\"$completedate\", deferred_flag=0, deferred_date=\"0000-00-00\" where eventid=\"$id\"");
+        mysqli_query($db, "update events set last_date=\"$completedate\", deferred_flag=0, deferred_date=\"0001-01-01\" where eventid=\"$id\"");
         if ($addlognote) {
             $compltaskname = mysqli_fetch_row(mysqli_query($db, "select tasks.taskname from tasks,events where events.eventid=\"$id\" and tasks.taskid=events.task"))[0];
             $compldevicename = mysqli_fetch_row(mysqli_query($db, "select devices.devicename from devices,events where events.eventid=\"$id\" and devices.deviceid=events.device"))[0];
@@ -88,6 +88,7 @@ if ($action) {
         }
     }
     if ($defer) {
+        $deferuntil = fix_date($deferuntil);
         // update events
         mysqli_query($db, "update events set deferred_flag=1, deferred_date=\"$deferuntil\" where eventid=\"$id\"");
     }
@@ -110,9 +111,12 @@ if ($add) {
             $errorstack[] = "<img src=\"icons/exclamation-red.png\" border=\"0\">&nbsp;You didn't select a device.<br>";
         }
         // sanitize text data
-        $start_date = mysqli_real_escape_string($db, $start_date);
-        $last_date = mysqli_real_escape_string($db, $last_date);
-        $deferred_date = mysqli_real_escape_string($db, $deferred_date);
+        if ($start_date == NULL) $start_date = $today;
+        if ($last_date == NULL) $last_date = "0001-01-01";
+        if ($deferred_date == NULL) $deferred_date = "0001-01-01";
+        $start_date = fix_date($start_date);
+        $last_date = fix_date($last_date);
+        $deferred_date = fix_date($deferred_date);
         if ($taskselected && $deviceselected) {
             // determine if device represents a group and break out individual devices
             if (dblookup($db, "devices", "deviceid", "group_flag", $device)) {
@@ -126,9 +130,6 @@ if ($add) {
             }
             // run through the memberlist and modify the table
             foreach ($memberlist as $memberdev) {
-                if ($start_date == NULL) $start_date = $today;
-                if ($last_date == NULL) $last_date = "0000-00-00";
-                if ($deferred_date == NULL) $deferred_date = "0000-00-00";
                 $addqry = ("insert into events(task,device,start_date,last_date,deferred_flag,deferred_date,active_flag) 
                 values(\"$task\",\"$memberdev\",\"$start_date\",\"$last_date\",\"$deferred_flag\",\"$deferred_date\",\"$active_flag\")");
                 mysqli_query($db, $addqry);
@@ -199,13 +200,13 @@ if ($edit) {
         if ($update) {
             // do error checking
             // sanitize text data
-            $start_date = mysqli_real_escape_string($db, $start_date);
-            $last_date = mysqli_real_escape_string($db, $last_date);
-            $deferred_date = mysqli_real_escape_string($db, $deferred_date);
-            // update the tasks table
             if ($start_date == NULL) $start_date = $today;
-            if ($last_date == NULL) $last_date = "0000-00-00";
-            if ($deferred_date == NULL) $deferred_date = "0000-00-00";
+            if ($last_date == NULL) $last_date = "0001-01-01";
+            if ($deferred_date == NULL) $deferred_date = "0001-01-01";
+            $start_date = fix_date($start_date);
+            $last_date = fix_date($last_date);
+            $deferred_date = fix_date($deferred_date);
+            // update the tasks table
             mysqli_query($db, "update events 
             set task=\"$task\",device=\"$device\",start_date=\"$start_date\",last_date=\"$last_date\",deferred_flag=\"$deferred_flag\",
             deferred_date=\"$deferred_date\",active_flag=\"$active_flag\" 
@@ -404,9 +405,9 @@ if ($action) {
         } else {
             $deferredtag = "<input type=\"checkbox\" name=\"deferred_flag\" value=\"1\">";
         }
-        if ($start_date == "0000-00-00") $start_date = $today;
-        if ($last_date == "0000-00-00") $last_date = "";
-        if ($deferred_date == "0000-00-00") $deferred_date = $tomorrow;
+        if ($start_date == "0001-01-01") $start_date = $today;
+        //if ($last_date == "0001-01-01") $last_date = "";
+        if ($deferred_date == "0001-01-01") $deferred_date = $tomorrow;
         $deferuntiltag = "<input type=\"text\" name=\"deferred_date\" id=\"deferdatepicker\" size=\"10\" maxlength=\"10\" value=\"$deferred_date\" title=\"Format: YYYY-MM-DD\">";
         $startdatetag = "<input type=\"text\" name=\"start_date\" id=\"startdatepicker\" size=\"10\" maxlength=\"10\" value=\"$start_date\" title=\"Format: YYYY-MM-DD\">";
         $lastdatetag = "<input type=\"text\" name=\"last_date\" id=\"completedatepicker\" size=\"10\" maxlength=\"10\" value=\"$last_date\" title=\"Format: YYYY-MM-DD\">";
@@ -487,9 +488,9 @@ if ($action) {
     ";
     while ($tablerow = mysqli_fetch_assoc($existingdata)) {
         extract($tablerow);
-        if ($start_date == "0000-00-00") $start_date = $today;
-        if ($last_date == "0000-00-00") $last_date = "";
-        if ($deferred_date == "0000-00-00") $deferred_date = "";
+        if ($start_date == "0001-01-01") $start_date = $today;
+        if ($last_date == "0001-01-01") $last_date = "";
+        if ($deferred_date == "0001-01-01") $deferred_date = "";
         if ($active_flag) {
             $statdef = "<img src=\"icons/tick.png\" title=\"active\" alt=\"active\">";
         } else {
@@ -855,7 +856,7 @@ if ($action) {
         $taskdata = mysqli_fetch_assoc(mysqli_query($db, "select * from tasks where taskid=\"$def_task\""));
         extract($taskdata, EXTR_PREFIX_ALL, "taskdata");
         if (! ($taskdata_period == "once" && $def_last_date > $def_start_date)) {
-            if ($def_last_date == "0000-00-00") {
+            if ($def_last_date == "0001-01-01") {
                 $lastdatestrg = "never";
             } else {
                 $lastdatestrg = "$def_last_date";

distfiles/search.php

@@ -35,7 +35,7 @@ $srchploc = $_REQUEST['srchploc'] ?? NULL;
 $srchnha = $_REQUEST['srchnha'] ?? NULL;
 $srchrepord = $_REQUEST['srchrepord'] ?? NULL;
 $srchflags = $_POST['srchflags'] ?? [];
-$target = $_REQUEST['target'] ?? NULL;
+$target = $_REQUEST['target'] ?? ["log", "maintform", "part"];
 
 $doparts = PARTS_FUNCTIONS;
 $logname = LOG_NAME;
@@ -56,7 +56,7 @@ framework("begin", "$logname Search", "Search", $print);
 
 // echo "REQUEST variables: <br>";
 // var_dump($_REQUEST);
-
+// echo "<br>";
 
 // ******** begin database manipulation ********
 
@@ -92,7 +92,6 @@ if ($search) {
     $srchpname = trim($srchpname);
     $srchploc = trim($srchploc);
     $srchnha = trim($srchnha);
-    if ($target[0] == "") $target = [];
     if (in_array("log", $target)) {
         // define the query constraints 
         // log note id
@@ -131,23 +130,6 @@ if ($search) {
             $logfromtables[] = "lognotes";
             $logconstraints[] = "lognotes.lognote like \"%$srchtext%\"";
         }
-        // flags
-        if (!empty($srchflags)) {
-            unset($flagconstraints);
-            $flagcount = count($srchflags);
-            $logfromtables[] = "lognotes";
-            $logfromtables[] = "flagmap";
-            $flagconstraints[] = "flagmap.lognoteid=lognotes.lognoteid and flagmap.flagid in (";
-            foreach ($srchflags as $flagid) {
-                $flagconstraints[] = "\"$flagid\"";
-                $flagconstraints[] = ",";
-            }
-            // remove final comma
-            array_splice($flagconstraints, -1, 1);
-            $flagconstraints[] = ") group by flagmap.lognoteid having count(distinct flagmap.flagid)=$flagcount";
-            // make flagconstraints a single string so that the final implode doesn't split it
-            $logconstraints[] = join('', $flagconstraints);
-        }
         // uid
         if ($srchuid != "any" && $srchuid != "") {
             $logfromtables[] = "lognotes";
@@ -200,12 +182,28 @@ if ($search) {
             $logfromtables[] = "maintforms";
             $logconstraints[] = "lognotes.lognoteid=logparts.lognoteid and logparts.partid=parts.partid and maintforms.mfpart=parts.partid and maintforms.repord=\"{$srchrepord}\"";
         }
+        // flags
+        if (!empty($srchflags)) {
+            unset($flagconstraints);
+            $flagcount = count($srchflags);
+            $logfromtables[] = "lognotes";
+            $logfromtables[] = "flagmap";
+            $flagconstraints[] = "flagmap.lognoteid=lognotes.lognoteid and flagmap.flagid in (";
+            foreach ($srchflags as $flagid) {
+                $flagconstraints[] = "\"$flagid\"";
+                $flagconstraints[] = ",";
+            }
+            // remove final comma
+            array_splice($flagconstraints, -1, 1);
+            $flagconstraints[] = ") group by flagmap.lognoteid having count(distinct flagmap.flagid)=$flagcount";
+            // make flagconstraints a single string so that the final implode doesn't split it
+            $logconstraints[] = join('', $flagconstraints);
+        }
         // build the clauses and run the query
         $logfromclause = implode(",", array_unique($logfromtables));
         $logwhereclause = implode(" and ", $logconstraints);
         $logrowqry = mysqli_query($db, "select lognotes.* from $logfromclause where $logwhereclause order by lognotes.date asc, lognotes.time asc");
     }
-    if ($target[0] == "") $target = [];
     if (in_array("maintform", $target)) {
         // maintforms search
         // define the query constraints 
@@ -248,23 +246,6 @@ if ($search) {
             $mffromtables[] = "maintactions";
             $mfconstraints[] = "maintforms.mfmalfunction like \"%$srchtext%\" or (maintactions.action like \"%$srchtext%\" and maintforms.maintformid=maintactions.maintformnum)";
         }
-        // flags
-        if (!empty($srchflags)) {
-            unset($flagconstraints);
-            $flagcount = count($srchflags);
-            $mffromtables[] = "maintforms";
-            $mffromtables[] = "flagmap";
-            $flagconstraints[] = "flagmap.maintformid=maintforms.maintformid and flagmap.flagid in (";
-            foreach ($srchflags as $thisflagid) {
-                $flagconstraints[] = "\"$thisflagid\"";
-                $flagconstraints[] = ",";
-            }
-            // remove final comma
-            array_splice($flagconstraints, -1, 1);
-            $flagconstraints[] = ") group by flagmap.maintformid having count(distinct flagmap.flagid)=$flagcount";
-            // make flagconstraints a single string so that the final implode doesn't split it
-            $mfconstraints[] = join('', $flagconstraints);
-        }
         // uid
         if ($srchuid != "any" && $srchuid != "") {
             $mffromtables[] = "maintforms";
@@ -307,12 +288,28 @@ if ($search) {
             $mffromtables[] = "maintforms";
             $mfconstraints[] = "maintforms.mfpart=parts.partid and maintforms.repord=\"{$srchrepord}\"";
         }
+        // flags
+        if (!empty($srchflags)) {
+            unset($flagconstraints);
+            $flagcount = count($srchflags);
+            $mffromtables[] = "maintforms";
+            $mffromtables[] = "flagmap";
+            $flagconstraints[] = "flagmap.maintformid=maintforms.maintformid and flagmap.flagid in (";
+            foreach ($srchflags as $thisflagid) {
+                $flagconstraints[] = "\"$thisflagid\"";
+                $flagconstraints[] = ",";
+            }
+            // remove final comma
+            array_splice($flagconstraints, -1, 1);
+            $flagconstraints[] = ") group by flagmap.maintformid having count(distinct flagmap.flagid)=$flagcount";
+            // make flagconstraints a single string so that the final implode doesn't split it
+            $mfconstraints[] = join('', $flagconstraints);
+        }
         // build the clauses and run the query
         $mffromclause = implode(",", array_unique($mffromtables));
         $mfwhereclause = implode(" and ", $mfconstraints);
         $mfrowqry = mysqli_query($db, "select maintforms.* from $mffromclause where $mfwhereclause order by maintforms.mfdate asc, maintforms.mftime asc");
     }
-    if ($target[0] == "") $target = [];
     if (in_array("part", $target)) {
         // parts search
         // define the query constraints 
@@ -334,7 +331,6 @@ if ($search) {
         // tech doesn't apply to parts
         // subject doesn't apply to parts
         // search text doesn't apply to parts
-        // flags doesn't apply to parts
         // uid
         if ($srchuid != "any" && $srchuid != "") {
             $pfromtables[] = "parts";
@@ -373,6 +369,7 @@ if ($search) {
             $pfromtables[] = "maintforms";
             $pconstraints[] = "maintforms.mfpart=parts.partid and maintforms.repord=\"{$srchrepord}\"";
         }
+        // flags doesn't apply to parts
         // build the clauses and run the query
         $pfromclause = implode(",", array_unique($pfromtables));
         $pwhereclause = implode(" and ", $pconstraints);

distfiles/templates.php

@@ -162,6 +162,12 @@ if ($usertemplateid) {
     $loadtemplate = NULL;
 }
 
+// determine original owner of template
+$orig_owner = dblookup($db, "notetemplates", "templateid", "tech", $templateid);
+if ($efftechid != NULL && $efftechid != $orig_owner) {
+    $operation = "add";
+}
+
 if ($operation == "add") {
     if ($submit) {
         if ($note) {

install.sh

@@ -201,9 +201,36 @@ then
                 abort_exit
             else
                 # proceed with upgrade
-                
-                # take app offline during upgrade
-                a2disconf $install_loc_in
+                # put app in maintenance mode
+                echo "Putting the application in maintenance mode..."
+                # make sure mod_rewrite is enabled
+                if [[ ! -e "$APACHE_CONF_DIR/../mods-enabled/rewrite.load" ]]
+                then
+                    a2enmod -q rewrite
+                    systemctl restart apache2
+                fi
+                # disable the app
+                a2disconf -q $install_loc_in 
+                systemctl reload apache2
+                # modify the apache conf file
+                if ! grep -q "RewriteEngine" "$APACHE_CONF_DIR/$install_loc_in.conf"
+                then
+                    # this is an old version of the conf file. Replace with new version
+                    cp -f default-apache.conf $APACHE_CONF_DIR/$install_loc_in.conf
+                    sed -i "s|_APPNAME_|$APP_NAME|g" $APACHE_CONF_DIR/$install_loc_in.conf
+                    sed -i "s|_BASEURL_|$install_loc_in|g" $APACHE_CONF_DIR/$install_loc_in.conf
+                    sed -i "s|_DOCROOTIN_|$doc_root_in|g" $APACHE_CONF_DIR/$install_loc_in.conf
+                fi
+                sed -i "s|#Rewrite|Rewrite|g" $APACHE_CONF_DIR/$install_loc_in.conf
+                # copy in the default maintenancemode.php if it's not already there
+                if [[ ! -e "$install_path/maintenancemode.php" ]]
+                then
+                    cp maintenancemode.php $install_path/
+                    # modify the maintenancemode.php file
+                    sed -i "s|_APPNAME_|$APP_NAME|g" $install_path/maintenancemode.php
+                fi
+                # re-enable the app in maintenance mode
+                a2enconf -q $install_loc_in
                 systemctl reload apache2
                 
                 datestamp=$(date +%Y-%m-%d_%H:%M:%S)
@@ -231,8 +258,8 @@ then
                 echo "Backing up current installation to the package directory."
                 cp -R $install_path $backupdir/$install_loc_in-$datestamp-backup
                 
-                # delete all existing installation files except db.php
-                find $install_path/ -mindepth 1 -not -name 'db.php' -delete
+                # delete all existing installation files except db.php and maintenancemode.php
+                find $install_path/ -mindepth 1 ! \( -name 'db.php' -o -name 'maintenancemode.php' \) -delete
                 
                 echo "Performing database updates..."
                 # apply database updates from sql file
@@ -271,6 +298,17 @@ then
                 chown -R $httpd_user_group $install_path
                 echo "Backups of the previous openlog files and the previous database were made"
                 echo "and are located in the $backupdir directory."
+
+                # take app out of maintenance mode
+                echo "Taking the app out of maintenance mode..."
+                # disable the app
+                a2disconf -q $install_loc_in 
+                systemctl reload apache2
+                # modify the apache conf file
+                sed -i "s|Rewrite|#Rewrite|g" $APACHE_CONF_DIR/$install_loc_in.conf
+                # re-enable the app in production mode
+                a2enconf -q $install_loc_in
+                systemctl reload apache2
             fi
         else
             # This was a mistake. Exit now to avoid clobbering another app.
@@ -369,10 +407,16 @@ else
     if [[ ! -f "$install_path/db.php" ]]
     then
         cp db.php.template $install_path/db.php
-        sed -i "s/DBNAME/$new_db_name/g" $install_path/db.php
-        sed -i "s/DBUSER/$db_user/g" $install_path/db.php
-        sed -i "s/DBPASS/$db_pass/g" $install_path/db.php
-        sed -i "s/APPNAME/$APP_NAME/g" $install_path/db.php
+        sed -i "s|DBNAME|$new_db_name|g" $install_path/db.php
+        sed -i "s|DBUSER|$db_user|g" $install_path/db.php
+        sed -i "s|DBPASS|$db_pass|g" $install_path/db.php
+        sed -i "s|APPNAME|$APP_NAME|g" $install_path/db.php
+    fi
+    # Create maintenancemode.php if it doesn't exist
+    if [[ ! -f "$install_path/maintenancemode.php" ]]
+    then
+        cp maintenancemode.php $install_path/maintenancemode.php
+        sed -i "s|_APPNAME_|$APP_NAME|g" $install_path/maintenancemode.php
     fi
     
     # copy distribution to install location
@@ -407,25 +451,21 @@ echo "$APP_NAME has been $operation."
 base_url=$install_loc_in
 if [[ "$operation" == "upgraded" ]]
 then
-    a2enconf $base_url
+    a2enconf -q $base_url
     systemctl reload apache2
 fi
 if [[ "$operation" == "installed" ]]
 then
-    echo "# $APP_NAME default Apache configuration" > $APACHE_CONF_DIR/$base_url.conf
-    echo "" >> $APACHE_CONF_DIR/$base_url.conf
-    echo "Alias /$base_url $doc_root_in/$base_url" >> $APACHE_CONF_DIR/$base_url.conf
-    echo "" >> $APACHE_CONF_DIR/$base_url.conf
-    echo "<Directory $doc_root_in/$base_url>" >> $APACHE_CONF_DIR/$base_url.conf
-    echo "    AllowOverride Options" >> $APACHE_CONF_DIR/$base_url.conf
-    echo "    Options FollowSymLinks" >> $APACHE_CONF_DIR/$base_url.conf
-    echo "    DirectoryIndex index.php" >> $APACHE_CONF_DIR/$base_url.conf
-    echo "</Directory>" >> $APACHE_CONF_DIR/$base_url.conf
+    cp -f default-apache.conf $APACHE_CONF_DIR/$base_url.conf
+    sed -i "s|_APPNAME_|$APP_NAME|g" $APACHE_CONF_DIR/$base_url.conf
+    sed -i "s|_BASEURL_|$base_url|g" $APACHE_CONF_DIR/$base_url.conf
+    sed -i "s|_DOCROOTIN_|$doc_root_in|g" $APACHE_CONF_DIR/$base_url.conf
+    
     echo -n "The apache2 $base_url configuration must be enabled. Would you like to do that now? [Y/n] :"
     read enconf
     if [[ "$enconf" == "" || "$enconf" == "Y" || "$enconf" == "y" ]] 
     then
-        a2enconf $base_url.conf >/dev/null
+        a2enconf -q $base_url.conf >/dev/null
         systemctl reload apache2
         echo "You can now point a web browser to $base_url on your web server "
         echo "to set up and configure $APP_NAME."

maintenancemode.php

@@ -0,0 +1,26 @@
+<?php
+/*
+    maintenancemode.php
+    OpenLog Online Logbook
+    Copyright (C) 2026  Rod Wright
+
+    SPDX-License-Identifier: GPL-2.0
+*/
+
+echo "
+<html>
+<head>
+<title>_APPNAME_</title>
+<style type=\"text/css\">
+    * {font-family: Arial, Helvetica, sans-serif;}
+</style>
+</head>
+<body>
+<br><br><br><br>
+_APPNAME_ is currently down for maintenance. Please try again later.
+<br><br>
+</body>
+</html>
+";
+
+?>