diff --git a/pub/api/classes/API.php b/pub/api/classes/API.php index cd9dab1..14e219d 100644 --- a/pub/api/classes/API.php +++ b/pub/api/classes/API.php @@ -751,12 +751,38 @@ class API $values[] = $from; $values[] = $to; } + + // ORDER BY + if (isset($builder['orderBy']) && is_array($builder['orderBy'])) { + + if (count($builder['orderBy']) !== 2) { + continue; + } + + $column = $builder['orderBy'][0]; + $direction = strtoupper($builder['orderBy'][1]); + + if (!in_array($column, $this->allowedGetColumns, true)) { + $this->apiOutput(400, ['error' => "The column $column is not allowed."]); + } + + if (!in_array($direction, ['ASC', 'DESC'], true)) { + $this->apiOutput(400, ['error' => "Invalid order direction."]); + } + + $orderByClauses[] = "$column $direction"; + } + } if (!empty($whereClauses)) { $this->baseQuery .= " WHERE " . implode(" AND ", $whereClauses); } + if (!empty($orderByClauses)) { + $this->baseQuery .= " ORDER BY " . implode(", ", $orderByClauses); + } + return [$this->baseQuery, $types, $values]; } diff --git a/pub/api/v1/office/travel-reimburse/index.php b/pub/api/v1/office/travel-reimburse/index.php index b960765..485d239 100644 --- a/pub/api/v1/office/travel-reimburse/index.php +++ b/pub/api/v1/office/travel-reimburse/index.php @@ -17,7 +17,17 @@ if (!$GLOBALS['modules_enabled']['office']) { if ($API_office_travel_reimburse->request_method === 'GET') { $API_office_travel_reimburse->checkPermissions('office-travel-reimburse', 'RO'); - $_GET['builder'] = [1 => ['where' => [0 => 'user_uuid', 1 => $_SESSION['user']['user_uuid']]]]; + if (!isset($_GET['builder']) || !is_array($_GET['builder'])) { + $_GET['builder'] = []; + } + + # Append user_uuid where builder to always search for the user_uuid that is requesting the travel entries + $_GET['builder'][] = [ + 'where' => [ + 0 => 'user_uuid', + 1 => $_SESSION['user']['user_uuid'] + ] + ]; $travel_reimbursements = $API_office_travel_reimburse->getTravelReimburse(); $API_office_travel_reimburse->apiOutput($code = 200, $travel_reimbursements); diff --git a/pub/api/v1/office/travel-reimburse/send/index.php b/pub/api/v1/office/travel-reimburse/send/index.php index 914a2da..e74ec96 100644 --- a/pub/api/v1/office/travel-reimburse/send/index.php +++ b/pub/api/v1/office/travel-reimburse/send/index.php @@ -20,8 +20,6 @@ if (!$GLOBALS['modules_enabled']['office']) { } if ($API_office_travel_reimburse->request_method === 'POST') { - - ini_set('display_errors', 1); $API_office_travel_reimburse->checkPermissions('office-travel-reimburse', 'RO'); $portal_settings = $GLOBALS['conn']->query("SELECT * FROM system_settings")->fetch_assoc(); $month = $_POST['calender_month']; @@ -38,6 +36,10 @@ if ($API_office_travel_reimburse->request_method === 'POST') { 0 => 'travel_date', 1 => $firstDay, 2 => $lastDay + ], + 'orderBy' => [ + 0 => 'travel_date', + 1 => 'ASC' ] ] ];