functions/abook_database.php

   1 <?php
   2
   3 /**
   4  * abook_database.php
   5  *
   6  * Supported database schema
   7  * <pre>
   8  *  owner varchar(128) NOT NULL
   9  *  nickname varchar(16) NOT NULL
  10  *  firstname varchar(128)
  11  *  lastname varchar(128)
  12  *  email varchar(128) NOT NULL
  13  *  label varchar(255)
  14  *  PRIMARY KEY (owner,nickname)
  15  * </pre>
  16  *
  17  * @copyright 1999-2016 The SquirrelMail Project Team
  18  * @license http://opensource.org/licenses/gpl-license.php GNU Public License
  19  * @version $Id$
  20  * @package squirrelmail
  21  * @subpackage addressbook
  22  */
  23
  24 /**
  25  * Needs either PDO or the DB functions
  26  * Don't display errors here. Error will be set in class constructor function.
  27  */
  28 global $use_pdo, $disable_pdo;
  29 if (empty($disable_pdo) && class_exists('PDO'))
  30     $use_pdo = TRUE;
  31 else
  32     $use_pdo = FALSE;
  33
  34 if (!$use_pdo)
  35     @include_once('DB.php');
  36
  37 /**
  38  * Address book in a database backend
  39  *
  40  * Backend for personal/shared address book stored in a database,
  41  * accessed using the DB-classes in PEAR or PDO, the latter taking
  42  * precedence if available..
  43  *
  44  * IMPORTANT:  If PDO is not available (it should be installed by
  45  *             default since PHP 5.1), then the PEAR modules must
  46  *             be in the include path for this class to work.
  47  *
  48  * An array with the following elements must be passed to
  49  * the class constructor (elements marked ? are optional):
  50  * <pre>
  51  *   dsn       => database DNS (see PEAR for syntax, but more or
  52  *                less it is:  mysql://user:pass@hostname/dbname)
  53  *   table     => table to store addresses in (must exist)
  54  *   owner     => current user (owner of address data)
  55  * ? name      => name of address book
  56  * ? writeable => set writeable flag (true/false)
  57  * ? listing   => enable/disable listing
  58  * </pre>
  59  * The table used should have the following columns:
  60  * owner, nickname, firstname, lastname, email, label
  61  * The pair (owner,nickname) should be unique (primary key).
  62  *
  63  *  NOTE. This class should not be used directly. Use the
  64  *        "AddressBook" class instead.
  65  *
  66  * Three settings that control PDO behavior can be specified in
  67  * config/config_local.php if needed:
  68  *    boolean $disable_pdo SquirrelMail uses PDO by default to access the
  69  *                         user preferences and address book databases, but
  70  *                         setting this to TRUE will cause SquirrelMail to
  71  *                         fall back to using Pear DB instead.
  72  *    boolean $pdo_show_sql_errors When database errors are encountered,
  73  *                                 setting this to TRUE causes the actual
  74  *                                 database error to be displayed, otherwise
  75  *                                 generic errors are displayed, preventing
  76  *                                 internal database information from being
  77  *                                 exposed. This should be enabled only for
  78  *                                 debugging purposes.
  79  *    string $pdo_identifier_quote_char By default, SquirrelMail will quote
  80  *                                      table and field names in database
  81  *                                      queries with what it thinks is the
  82  *                                      appropriate quote character for the
  83  *                                      database type being used (backtick
  84  *                                      for MySQL (and thus MariaDB), double
  85  *                                      quotes for all others), but you can
  86  *                                      override the character used by
  87  *                                      putting it here, or tell SquirrelMail
  88  *                                      NOT to quote identifiers by setting
  89  *                                      this to "none"
  90  *
  91  * @package squirrelmail
  92  * @subpackage addressbook
  93  */
  94 class abook_database extends addressbook_backend {
  95     /**
  96      * Backend type
  97      * @var string
  98      */
  99     var $btype = 'local';
 100     /**
 101      * Backend name
 102      * @var string
 103      */
 104     var $bname = 'database';
 105
 106     /**
 107      * Data Source Name (connection description)
 108      * @var string
 109      */
 110     var $dsn       = '';
 111
 112     /**
 113      * Character used to quote database table
 114      * and field names
 115      * @var string
 116      */
 117     var $identifier_quote_char = '';
 118
 119     /**
 120      * Table that stores addresses
 121      * @var string
 122      */
 123     var $table     = '';
 124     /**
 125      * Owner name
 126      *
 127      * Limits list of database entries visible to end user
 128      * @var string
 129      */
 130     var $owner     = '';
 131     /**
 132      * Database Handle
 133      * @var resource
 134      */
 135     var $dbh       = false;
 136     /**
 137      * Enable/disable writing into address book
 138      * @var bool
 139      */
 140     var $writeable = true;
 141     /**
 142      * Enable/disable address book listing
 143      * @var bool
 144      */
 145     var $listing = true;
 146
 147     /* ========================== Private ======================= */
 148
 149     /**
 150      * Constructor
 151      * @param array $param address book backend options
 152      */
 153     function abook_database($param) {
 154         $this->sname = _("Personal Address Book");
 155
 156         /* test if PDO or Pear DB classes are available and freak out if necessary */
 157         global $use_pdo;
 158         if (!$use_pdo && !class_exists('DB')) {
 159             // same error also in db_prefs.php
 160             $error  = _("Could not find or include PHP PDO or PEAR database functions required for the database backend.") . "\n";
 161             $error .= sprintf(_("PDO should come preinstalled with PHP version 5.1 or higher. Otherwise, is PEAR installed, and is the include path set correctly to find %s?"), 'DB.php') . "\n";
 162             $error .= _("Please contact your system administrator and report this error.");
 163             return $this->set_error($error);
 164         }
 165
 166         if (is_array($param)) {
 167             if (empty($param['dsn']) ||
 168                 empty($param['table']) ||
 169                 empty($param['owner'])) {
 170                 return $this->set_error('Invalid parameters');
 171             }
 172
 173             $this->dsn   = $param['dsn'];
 174             $this->table = $param['table'];
 175             $this->owner = $param['owner'];
 176
 177             if (!empty($param['name'])) {
 178                $this->sname = $param['name'];
 179             }
 180
 181             if (isset($param['writeable'])) {
 182                $this->writeable = $param['writeable'];
 183             }
 184
 185             if (isset($param['listing'])) {
 186                $this->listing = $param['listing'];
 187             }
 188
 189             // figure out identifier quoting (only used for PDO, though we could change that)
 190             global $pdo_identifier_quote_char;
 191             if (empty($pdo_identifier_quote_char)) {
 192                 if (strpos($this->dsn, 'mysql') === 0)
 193                     $this->identifier_quote_char = '`';
 194                 else
 195                     $this->identifier_quote_char = '"';
 196             } else if ($pdo_identifier_quote_char === 'none')
 197                 $this->identifier_quote_char = '';
 198             else
 199                 $this->identifier_quote_char = $pdo_identifier_quote_char;
 200
 201
 202             $this->open(true);
 203         }
 204         else {
 205             return $this->set_error('Invalid argument to constructor');
 206         }
 207     }
 208
 209
 210     /**
 211      * Open the database.
 212      * @param bool $new new connection if it is true
 213      * @return bool
 214      */
 215     function open($new = false) {
 216         global $use_pdo;
 217         $this->error = '';
 218
 219         /* Return true is file is open and $new is unset */
 220         if ($this->dbh && !$new) {
 221             return true;
 222         }
 223
 224         /* Close old file, if any */
 225         if ($this->dbh) {
 226             $this->close();
 227         }
 228
 229         if ($use_pdo) {
 230             // parse and convert DSN to PDO style
 231             // $matches will contain:
 232             // 1: database type
 233             // 2: username
 234             // 3: password
 235             // 4: hostname
 236             // 5: database name
 237 //TODO: add support for unix_socket and charset
 238             if (!preg_match('|^(.+)://(.+):(.+)@(.+)/(.+)$|i', $this->dsn, $matches)) {
 239                 return $this->set_error(_("Could not parse prefs DSN"));
 240             }
 241             if (preg_match('|^(.+):(\d+)$|', $matches[4], $host_port_matches)) {
 242                 $matches[4] = $host_port_matches[1];
 243                 $matches[6] = $host_port_matches[2];
 244             } else
 245                 $matches[6] = NULL;
 246             $pdo_prefs_dsn = $matches[1] . ':host=' . $matches[4] . (!empty($matches[6]) ? ';port=' . $matches[6] : '') . ';dbname=' . $matches[5];
 247             try {
 248                 $dbh = new PDO($pdo_prefs_dsn, $matches[2], $matches[3]);
 249             } catch (Exception $e) {
 250                 return $this->set_error(sprintf(_("Database error: %s"), $e->getMessage()));
 251             }
 252
 253             $dbh->setAttribute(PDO::ATTR_CASE, PDO::CASE_LOWER);
 254
 255         } else {
 256             $dbh = DB::connect($this->dsn, true);
 257
 258             if (DB::isError($dbh)) {
 259                 return $this->set_error(sprintf(_("Database error: %s"),
 260                                                 DB::errorMessage($dbh)));
 261             }
 262
 263             /**
 264              * field names are lowercased.
 265              * We use unquoted identifiers and they use upper case in Oracle
 266              */
 267             $dbh->setOption('portability', DB_PORTABILITY_LOWERCASE);
 268         }
 269
 270         $this->dbh = $dbh;
 271         return true;
 272     }
 273
 274     /**
 275      * Close the file and forget the filehandle
 276      */
 277     function close() {
 278         global $use_pdo;
 279         if ($use_pdo) {
 280             $this->dbh = NULL;
 281         } else {
 282             $this->dbh->disconnect();
 283             $this->dbh = false;
 284         }
 285     }
 286
 287     /**
 288      * Determine internal database field name given one of
 289      * the SquirrelMail SM_ABOOK_FIELD_* constants
 290      *
 291      * @param integer $field The SM_ABOOK_FIELD_* contant to look up
 292      *
 293      * @return string The desired field name, or the string "ERROR"
 294      *                if the $field is not understood (the caller
 295      *                is responsible for handing errors)
 296      *
 297      */
 298     function get_field_name($field) {
 299         switch ($field) {
 300             case SM_ABOOK_FIELD_NICKNAME:
 301                 return 'nickname';
 302             case SM_ABOOK_FIELD_FIRSTNAME:
 303                 return 'firstname';
 304             case SM_ABOOK_FIELD_LASTNAME:
 305                 return 'lastname';
 306             case SM_ABOOK_FIELD_EMAIL:
 307                 return 'email';
 308             case SM_ABOOK_FIELD_LABEL:
 309                 return 'label';
 310             default:
 311                 return 'ERROR';
 312         }
 313     }
 314
 315     /* ========================== Public ======================== */
 316
 317     /**
 318      * Search the database
 319      *
 320      * Backend supports only * and ? wildcards. Complex eregs are not supported.
 321      * Search is case insensitive.
 322      * @param string $expr search expression
 323      * @return array search results. boolean false on error
 324      */
 325     function search($expr) {
 326         $ret = array();
 327         if(!$this->open()) {
 328             return false;
 329         }
 330
 331         /* To be replaced by advanded search expression parsing */
 332         if (is_array($expr)) {
 333             return;
 334         }
 335
 336         // don't allow wide search when listing is disabled.
 337         if ($expr=='*' && ! $this->listing)
 338             return array();
 339
 340         /* lowercase expression in order to make it case insensitive */
 341         $expr = strtolower($expr);
 342
 343         /* escape SQL wildcards */
 344         $expr = str_replace('_', '\\_', $expr);
 345         $expr = str_replace('%', '\\%', $expr);
 346
 347         /* Convert wildcards to SQL syntax  */
 348         $expr = str_replace('?', '_', $expr);
 349         $expr = str_replace('*', '%', $expr);
 350
 351         $expr = "%$expr%";
 352
 353         global $use_pdo, $pdo_show_sql_errors;
 354         if ($use_pdo) {
 355             if (!($sth = $this->dbh->prepare('SELECT * FROM ' . $this->identifier_quote_char . $this->table . $this->identifier_quote_char . ' WHERE ' . $this->identifier_quote_char . 'owner' . $this->identifier_quote_char . ' = ? AND (LOWER(' . $this->identifier_quote_char . 'firstname' . $this->identifier_quote_char . ') LIKE ? ESCAPE ? OR LOWER(' . $this->identifier_quote_char . 'lastname' . $this->identifier_quote_char . ') LIKE ? ESCAPE ? OR LOWER(' . $this->identifier_quote_char . 'email' . $this->identifier_quote_char . ') LIKE ? ESCAPE ? OR LOWER(' . $this->identifier_quote_char . 'nickname' . $this->identifier_quote_char . ') LIKE ? ESCAPE ?)'))) {
 356                 if ($pdo_show_sql_errors)
 357                     return $this->set_error(sprintf(_("Database error: %s"), implode(' - ', $this->dbh->errorInfo())));
 358                 else
 359                     return $this->set_error(sprintf(_("Database error: %s"), _("Could not prepare query")));
 360             }
 361             if (!($res = $sth->execute(array($this->owner, $expr, '\\', $expr, '\\', $expr, '\\', $expr, '\\')))) {
 362                 if ($pdo_show_sql_errors)
 363                     return $this->set_error(sprintf(_("Database error: %s"), implode(' - ', $sth->errorInfo())));
 364                 else
 365                     return $this->set_error(sprintf(_("Database error: %s"), _("Could not execute query")));
 366             }
 367
 368             while ($row = $sth->fetch(PDO::FETCH_ASSOC)) {
 369                 array_push($ret, array('nickname'  => $row['nickname'],
 370                                        'name'      => $this->fullname($row['firstname'], $row['lastname']),
 371                                        'firstname' => $row['firstname'],
 372                                        'lastname'  => $row['lastname'],
 373                                        'email'     => $row['email'],
 374                                        'label'     => $row['label'],
 375                                        'backend'   => $this->bnum,
 376                                        'source'    => &$this->sname));
 377             }
 378
 379         } else {
 380             $expr = $this->dbh->quoteString($expr);
 381
 382             /* create escape expression */
 383             $escape = 'ESCAPE \'' . $this->dbh->quoteString('\\') . '\'';
 384
 385             $query = sprintf("SELECT * FROM %s WHERE owner='%s' AND " .
 386                              "(LOWER(firstname) LIKE '%s' %s " .
 387                              "OR LOWER(lastname) LIKE '%s' %s " .
 388                              "OR LOWER(email) LIKE '%s' %s " .
 389                              "OR LOWER(nickname) LIKE '%s' %s)",
 390                              $this->table, $this->owner, $expr, $escape, $expr, $escape,
 391                                                          $expr, $escape, $expr, $escape);
 392             $res = $this->dbh->query($query);
 393
 394             if (DB::isError($res)) {
 395                 return $this->set_error(sprintf(_("Database error: %s"),
 396                                                 DB::errorMessage($res)));
 397             }
 398
 399             while ($row = $res->fetchRow(DB_FETCHMODE_ASSOC)) {
 400                 array_push($ret, array('nickname'  => $row['nickname'],
 401                                        'name'      => $this->fullname($row['firstname'], $row['lastname']),
 402                                        'firstname' => $row['firstname'],
 403                                        'lastname'  => $row['lastname'],
 404                                        'email'     => $row['email'],
 405                                        'label'     => $row['label'],
 406                                        'backend'   => $this->bnum,
 407                                        'source'    => &$this->sname));
 408             }
 409         }
 410         return $ret;
 411     }
 412
 413     /**
 414      * Lookup an address by the indicated field.
 415      *
 416      * @param string  $value The value to look up
 417      * @param integer $field The field to look in, should be one
 418      *                       of the SM_ABOOK_FIELD_* constants
 419      *                       defined in include/constants.php
 420      *                       (OPTIONAL; defaults to nickname field)
 421      *                       NOTE: uniqueness is only guaranteed
 422      *                       when the nickname field is used here;
 423      *                       otherwise, the first matching address
 424      *                       is returned.
 425      *
 426      * @return array Array with lookup results when the value
 427      *               was found, an empty array if the value was
 428      *               not found.
 429      *
 430      */
 431     function lookup($value, $field=SM_ABOOK_FIELD_NICKNAME) {
 432         if (empty($value)) {
 433             return array();
 434         }
 435
 436         $value = strtolower($value);
 437
 438         if (!$this->open()) {
 439             return false;
 440         }
 441
 442         $db_field = $this->get_field_name($field);
 443         if ($db_field == 'ERROR') {
 444             return $this->set_error(sprintf(_("Unknown field name: %s"), $field));
 445         }
 446
 447         global $use_pdo, $pdo_show_sql_errors;
 448         if ($use_pdo) {
 449             if (!($sth = $this->dbh->prepare('SELECT * FROM ' . $this->identifier_quote_char . $this->table . $this->identifier_quote_char . ' WHERE ' . $this->identifier_quote_char . 'owner' . $this->identifier_quote_char . ' = ? AND LOWER(' . $this->identifier_quote_char . $db_field . $this->identifier_quote_char . ') = ?'))) {
 450                 if ($pdo_show_sql_errors)
 451                     return $this->set_error(sprintf(_("Database error: %s"), implode(' - ', $this->dbh->errorInfo())));
 452                 else
 453                     return $this->set_error(sprintf(_("Database error: %s"), _("Could not prepare query")));
 454             }
 455             if (!($res = $sth->execute(array($this->owner, $value)))) {
 456                 if ($pdo_show_sql_errors)
 457                     return $this->set_error(sprintf(_("Database error: %s"), implode(' - ', $sth->errorInfo())));
 458                 else
 459                     return $this->set_error(sprintf(_("Database error: %s"), _("Could not execute query")));
 460             }
 461
 462             if ($row = $sth->fetch(PDO::FETCH_ASSOC)) {
 463                 return array('nickname'  => $row['nickname'],
 464                              'name'      => $this->fullname($row['firstname'], $row['lastname']),
 465                              'firstname' => $row['firstname'],
 466                              'lastname'  => $row['lastname'],
 467                              'email'     => $row['email'],
 468                              'label'     => $row['label'],
 469                              'backend'   => $this->bnum,
 470                              'source'    => &$this->sname);
 471             }
 472
 473         } else {
 474             $query = sprintf("SELECT * FROM %s WHERE owner = '%s' AND LOWER(%s) = '%s'",
 475                              $this->table, $this->owner, $db_field,
 476                              $this->dbh->quoteString($value));
 477
 478             $res = $this->dbh->query($query);
 479
 480             if (DB::isError($res)) {
 481                 return $this->set_error(sprintf(_("Database error: %s"),
 482                                                 DB::errorMessage($res)));
 483             }
 484
 485             if ($row = $res->fetchRow(DB_FETCHMODE_ASSOC)) {
 486                 return array('nickname'  => $row['nickname'],
 487                              'name'      => $this->fullname($row['firstname'], $row['lastname']),
 488                              'firstname' => $row['firstname'],
 489                              'lastname'  => $row['lastname'],
 490                              'email'     => $row['email'],
 491                              'label'     => $row['label'],
 492                              'backend'   => $this->bnum,
 493                              'source'    => &$this->sname);
 494             }
 495         }
 496
 497         return array();
 498     }
 499
 500     /**
 501      * List all addresses
 502      * @return array search results
 503      */
 504     function list_addr() {
 505         $ret = array();
 506         if (!$this->open()) {
 507             return false;
 508         }
 509
 510         if(isset($this->listing) && !$this->listing) {
 511             return array();
 512         }
 513
 514
 515         global $use_pdo, $pdo_show_sql_errors;
 516         if ($use_pdo) {
 517             if (!($sth = $this->dbh->prepare('SELECT * FROM ' . $this->identifier_quote_char . $this->table . $this->identifier_quote_char . ' WHERE ' . $this->identifier_quote_char . 'owner' . $this->identifier_quote_char . ' = ?'))) {
 518                 if ($pdo_show_sql_errors)
 519                     return $this->set_error(sprintf(_("Database error: %s"), implode(' - ', $this->dbh->errorInfo())));
 520                 else
 521                     return $this->set_error(sprintf(_("Database error: %s"), _("Could not prepare query")));
 522             }
 523             if (!($res = $sth->execute(array($this->owner)))) {
 524                 if ($pdo_show_sql_errors)
 525                     return $this->set_error(sprintf(_("Database error: %s"), implode(' - ', $sth->errorInfo())));
 526                 else
 527                     return $this->set_error(sprintf(_("Database error: %s"), _("Could not execute query")));
 528             }
 529
 530             while ($row = $sth->fetch(PDO::FETCH_ASSOC)) {
 531                 array_push($ret, array('nickname'  => $row['nickname'],
 532                                        'name'      => $this->fullname($row['firstname'], $row['lastname']),
 533                                        'firstname' => $row['firstname'],
 534                                        'lastname'  => $row['lastname'],
 535                                        'email'     => $row['email'],
 536                                        'label'     => $row['label'],
 537                                        'backend'   => $this->bnum,
 538                                        'source'    => &$this->sname));
 539             }
 540         } else {
 541             $query = sprintf("SELECT * FROM %s WHERE owner='%s'",
 542                              $this->table, $this->owner);
 543
 544             $res = $this->dbh->query($query);
 545
 546             if (DB::isError($res)) {
 547                 return $this->set_error(sprintf(_("Database error: %s"),
 548                                                 DB::errorMessage($res)));
 549             }
 550
 551             while ($row = $res->fetchRow(DB_FETCHMODE_ASSOC)) {
 552                 array_push($ret, array('nickname'  => $row['nickname'],
 553                                        'name'      => $this->fullname($row['firstname'], $row['lastname']),
 554                                        'firstname' => $row['firstname'],
 555                                        'lastname'  => $row['lastname'],
 556                                        'email'     => $row['email'],
 557                                        'label'     => $row['label'],
 558                                        'backend'   => $this->bnum,
 559                                        'source'    => &$this->sname));
 560             }
 561         }
 562
 563         return $ret;
 564     }
 565
 566     /**
 567      * Add address
 568      * @param array $userdata added data
 569      * @return bool
 570      */
 571     function add($userdata) {
 572         if (!$this->writeable) {
 573             return $this->set_error(_("Address book is read-only"));
 574         }
 575
 576         if (!$this->open()) {
 577             return false;
 578         }
 579
 580         // NB: if you want to check for some unwanted characters
 581         //     or other problems, do so here like this:
 582         // TODO: Should pull all validation code out into a separate function
 583         //if (strpos($userdata['nickname'], ' ')) {
 584         //    return $this->set_error(_("Nickname contains illegal characters"));
 585         //}
 586
 587         /* See if user exist already */
 588         $ret = $this->lookup($userdata['nickname']);
 589         if (!empty($ret)) {
 590             return $this->set_error(sprintf(_("User \"%s\" already exists"), $ret['nickname']));
 591         }
 592
 593         global $use_pdo, $pdo_show_sql_errors;
 594         if ($use_pdo) {
 595             if (!($sth = $this->dbh->prepare('INSERT INTO ' . $this->identifier_quote_char . $this->table . $this->identifier_quote_char . ' (' . $this->identifier_quote_char . 'owner' . $this->identifier_quote_char . ', ' . $this->identifier_quote_char . 'nickname' . $this->identifier_quote_char . ', ' . $this->identifier_quote_char . 'firstname' . $this->identifier_quote_char . ', ' . $this->identifier_quote_char . 'lastname' . $this->identifier_quote_char . ', ' . $this->identifier_quote_char . 'email' . $this->identifier_quote_char . ', ' . $this->identifier_quote_char . 'label' . $this->identifier_quote_char . ') VALUES (?, ?, ?, ?, ?, ?)'))) {
 596                 if ($pdo_show_sql_errors)
 597                     return $this->set_error(sprintf(_("Database error: %s"), implode(' - ', $this->dbh->errorInfo())));
 598                 else
 599                     return $this->set_error(sprintf(_("Database error: %s"), _("Could not prepare query")));
 600             }
 601             if (!($res = $sth->execute(array($this->owner, $userdata['nickname'], $userdata['firstname'], (!empty($userdata['lastname']) ? $userdata['lastname'] : ''), $userdata['email'], (!empty($userdata['label']) ? $userdata['label'] : ''))))) {
 602                 if ($pdo_show_sql_errors)
 603                     return $this->set_error(sprintf(_("Database error: %s"), implode(' - ', $sth->errorInfo())));
 604                 else
 605                     return $this->set_error(sprintf(_("Database error: %s"), _("Could not execute query")));
 606             }
 607         } else {
 608             /* Create query */
 609             $query = sprintf("INSERT INTO %s (owner, nickname, firstname, " .
 610                              "lastname, email, label) VALUES('%s','%s','%s'," .
 611                              "'%s','%s','%s')",
 612                              $this->table, $this->owner,
 613                              $this->dbh->quoteString($userdata['nickname']),
 614                              $this->dbh->quoteString($userdata['firstname']),
 615                              $this->dbh->quoteString((!empty($userdata['lastname'])?$userdata['lastname']:'')),
 616                              $this->dbh->quoteString($userdata['email']),
 617                              $this->dbh->quoteString((!empty($userdata['label'])?$userdata['label']:'')) );
 618
 619             /* Do the insert */
 620             $r = $this->dbh->simpleQuery($query);
 621
 622             /* Check for errors */
 623             if (DB::isError($r)) {
 624                 return $this->set_error(sprintf(_("Database error: %s"),
 625                                                 DB::errorMessage($r)));
 626             }
 627         }
 628
 629          return true;
 630     }
 631
 632     /**
 633      * Deletes address book entries
 634      * @param array $alias aliases that have to be deleted. numerical
 635      *  array with nickname values
 636      * @return bool
 637      */
 638     function remove($alias) {
 639         if (!$this->writeable) {
 640             return $this->set_error(_("Address book is read-only"));
 641         }
 642
 643         if (!$this->open()) {
 644             return false;
 645         }
 646
 647         global $use_pdo, $pdo_show_sql_errors;
 648         if ($use_pdo) {
 649             $sepstr = '';
 650             $where_clause = '';
 651             $where_clause_args = array();
 652             while (list($undef, $nickname) = each($alias)) {
 653                 $where_clause .= $sepstr . $this->identifier_quote_char . 'nickname' . $this->identifier_quote_char . ' = ?';
 654                 $where_clause_args[] = $nickname;
 655                 $sepstr = ' OR ';
 656             }
 657             if (!($sth = $this->dbh->prepare('DELETE FROM ' . $this->identifier_quote_char . $this->table . $this->identifier_quote_char . ' WHERE ' . $this->identifier_quote_char . 'owner' . $this->identifier_quote_char . ' = ? AND (' . $where_clause . ')'))) {
 658                 if ($pdo_show_sql_errors)
 659                     return $this->set_error(sprintf(_("Database error: %s"), implode(' - ', $this->dbh->errorInfo())));
 660                 else
 661                     return $this->set_error(sprintf(_("Database error: %s"), _("Could not prepare query")));
 662             }
 663             array_unshift($where_clause_args, $this->owner);
 664             if (!($res = $sth->execute($where_clause_args))) {
 665                 if ($pdo_show_sql_errors)
 666                     return $this->set_error(sprintf(_("Database error: %s"), implode(' - ', $sth->errorInfo())));
 667                 else
 668                     return $this->set_error(sprintf(_("Database error: %s"), _("Could not execute query")));
 669             }
 670         } else {
 671             /* Create query */
 672             $query = sprintf("DELETE FROM %s WHERE owner='%s' AND (",
 673                              $this->table, $this->owner);
 674
 675             $sepstr = '';
 676             while (list($undef, $nickname) = each($alias)) {
 677                 $query .= sprintf("%s nickname='%s' ", $sepstr,
 678                                   $this->dbh->quoteString($nickname));
 679                 $sepstr = 'OR';
 680             }
 681             $query .= ')';
 682
 683             /* Delete entry */
 684             $r = $this->dbh->simpleQuery($query);
 685
 686             /* Check for errors */
 687             if (DB::isError($r)) {
 688                 return $this->set_error(sprintf(_("Database error: %s"),
 689                                                 DB::errorMessage($r)));
 690             }
 691         }
 692
 693         return true;
 694     }
 695
 696     /**
 697      * Modify address
 698      * @param string $alias modified alias
 699      * @param array $userdata new data
 700      * @return bool
 701      */
 702     function modify($alias, $userdata) {
 703         if (!$this->writeable) {
 704             return $this->set_error(_("Address book is read-only"));
 705         }
 706
 707         if (!$this->open()) {
 708             return false;
 709         }
 710
 711         // NB: if you want to check for some unwanted characters
 712         //     or other problems, do so here like this:
 713         // TODO: Should pull all validation code out into a separate function
 714         //if (strpos($userdata['nickname'], ' ')) {
 715         //    return $this->set_error(_("Nickname contains illegal characters"));
 716         //}
 717
 718          /* See if user exist */
 719         $ret = $this->lookup($alias);
 720         if (empty($ret)) {
 721             return $this->set_error(sprintf(_("User \"%s\" does not exist"),$alias));
 722         }
 723
 724         /* make sure that new nickname is not used */
 725         if (strtolower($alias) != strtolower($userdata['nickname'])) {
 726             /* same check as in add() */
 727             $ret = $this->lookup($userdata['nickname']);
 728             if (!empty($ret)) {
 729                 $error = sprintf(_("User '%s' already exist."), $ret['nickname']);
 730                 return $this->set_error($error);
 731             }
 732         }
 733
 734         global $use_pdo, $pdo_show_sql_errors;
 735         if ($use_pdo) {
 736             if (!($sth = $this->dbh->prepare('UPDATE ' . $this->identifier_quote_char . $this->table . $this->identifier_quote_char . ' SET ' . $this->identifier_quote_char . 'nickname' . $this->identifier_quote_char . ' = ?, ' . $this->identifier_quote_char . 'firstname' . $this->identifier_quote_char . ' = ?, ' . $this->identifier_quote_char . 'lastname' . $this->identifier_quote_char . ' = ?, ' . $this->identifier_quote_char . 'email' . $this->identifier_quote_char . ' = ?, ' . $this->identifier_quote_char . 'label' . $this->identifier_quote_char . ' = ? WHERE ' . $this->identifier_quote_char . 'owner' . $this->identifier_quote_char . ' = ? AND ' . $this->identifier_quote_char . 'nickname' . $this->identifier_quote_char . ' = ?'))) {
 737                 if ($pdo_show_sql_errors)
 738                     return $this->set_error(sprintf(_("Database error: %s"), implode(' - ', $this->dbh->errorInfo())));
 739                 else
 740                     return $this->set_error(sprintf(_("Database error: %s"), _("Could not prepare query")));
 741             }
 742             if (!($res = $sth->execute(array($userdata['nickname'], $userdata['firstname'], (!empty($userdata['lastname']) ? $userdata['lastname'] : ''), $userdata['email'], (!empty($userdata['label']) ? $userdata['label'] : ''), $this->owner, $alias)))) {
 743                 if ($pdo_show_sql_errors)
 744                     return $this->set_error(sprintf(_("Database error: %s"), implode(' - ', $sth->errorInfo())));
 745                 else
 746                     return $this->set_error(sprintf(_("Database error: %s"), _("Could not execute query")));
 747             }
 748         } else {
 749             /* Create query */
 750             $query = sprintf("UPDATE %s SET nickname='%s', firstname='%s', ".
 751                              "lastname='%s', email='%s', label='%s' ".
 752                              "WHERE owner='%s' AND nickname='%s'",
 753                              $this->table,
 754                              $this->dbh->quoteString($userdata['nickname']),
 755                              $this->dbh->quoteString($userdata['firstname']),
 756                              $this->dbh->quoteString((!empty($userdata['lastname'])?$userdata['lastname']:'')),
 757                              $this->dbh->quoteString($userdata['email']),
 758                              $this->dbh->quoteString((!empty($userdata['label'])?$userdata['label']:'')),
 759                              $this->owner,
 760                              $this->dbh->quoteString($alias) );
 761
 762             /* Do the insert */
 763             $r = $this->dbh->simpleQuery($query);
 764
 765             /* Check for errors */
 766             if (DB::isError($r)) {
 767                 return $this->set_error(sprintf(_("Database error: %s"),
 768                                                 DB::errorMessage($r)));
 769             }
 770         }
 771
 772         return true;
 773     }
 774 } /* End of class abook_database */
 775
 776 // vim: et ts=4