Calendar 2.0 (Page 2 of 12)

Its fixed in 1.2.1?
Im using 1.2.1

Gizzmo, is it only possible to write one row in the body?

Oh, thanks! I cant see any events in the small calendars eather..? (yes i have put in for the next month )

is this not tabular data though? or near enough

how is it going with the row-thing gizzmo?

I updates calendar.php ad i got no difference

well... this mod doesnt' work with postgresql...
to make it work:
in every query replace " to \', then, in your database :

 CREATE FUNCTION month(TIMESTAMP)
RETURNS INTEGER
LANGUAGE SQL
AS 'SELECT EXTRACT(MONTH FROM $1 )::integer;'
RETURNS NULL ON NULL INPUT; 
 CREATE FUNCTION year(TIMESTAMP)
RETURNS INTEGER
LANGUAGE SQL
AS 'SELECT EXTRACT(YEARFROM $1 )::integer;'
RETURNS NULL ON NULL INPUT; 
 CREATE FUNCTION dayofmonth(TIMESTAMP)
RETURNS INTEGER
LANGUAGE SQL
AS 'SELECT EXTRACT(DAYFROM $1 )::integer;'
RETURNS NULL ON NULL INPUT;

and replace in queries things like year(date) to year(date::timestamp)

PS there may be more problems, but these are first ones

BTW, SQL injection is possible in your mod.. try
http://your.host.com/path/calendar.php?month=3'

i know about this error it seems to be only happing in browsers other than IE. from my testing, and i dont know how to fix it. the way i get around it is just tab over and select it.

what do you mean, when your viewing the main calendar months? what is the error your geting?

hmm, i dono why its not working, it should. do you have the newest version?

what is SQL injection? rememeber im still a newbie at php coding. and im sorry about the postgresql, but i dont know anything about that and i dont use so there is no way for me to test it. i dont think i could implement it.

OK, this is HUGELY abusable with SQL injections. :-/
Until this is fixed, I would suggest anyone who has it installed on a publicly accessable site pull it down temporarily.

SQL injection basically means that it is possible to manipulate one or more variables in a way it wasn't intended, usually for malicious purposes. It is usually possible due to a lack of checking.

Example (lets say we're viewing stats on a user):

select * from user where id = $_GET['id']

I don't check that $_GET['id'] is a number (or do a simple intval()). That means that I could do this

select * from table where id = 0 union select password,password,(etc, however many columns there are) from table where id = [person I want to hack's ID]

If the passwords aren't hashed, I can just login as normal. If they are, the hashes can still be exploited in certain situations. And I could do this for any variable on any table.

However, it's easily fixed in this case. Where-ever you are taking in data from the outside that should be a number, make sure that it is, using something like this:
$var = intval($_GET['var'])
where var is the variable name.

Gizzmo, when you add an event in Firefox, the "Day" and "Year" functions do not work very well. In the Day drop down menu, you have to click and hold to select a day, and for the year, you have to select the text and continue to hold down the mouse button to edit the year.

I tried doing this in Internet Explorer and it works fine, but as Firefox takes up more and more of the market, you might want to check out the problem.