<% '============================================================================= ' FILE: displaypc.asp ' PURPOSE: Display detailed PC information with edit capability ' SECURITY: Parameterized queries, HTML encoding, input validation ' UPDATED: 2025-11-07 - Phase 2 migration (mirrors displaymachine.asp) - Migrated to secure patterns '============================================================================= %> <% theme = Request.Cookies("theme") If theme = "" Then theme = "bg-theme1" End If '============================================================================= ' SECURITY: Validate machineid or machinenumber parameter ' NOTE: This handles both database ID and machine number for flexibility '============================================================================= Dim pcid, hostname, paramValue pcid = GetSafeInteger("QS", "pcid", 0, 1, 999999) ' If machineid not provided, try machinenumber parameter IF pcid = 0 THEN hostname = Request.QueryString("hostname") IF hostname <> "" THEN ' Look up machineid by machinenumber Dim rsLookup, strLookupSQL strLookupSQL = "SELECT machineid FROM machines WHERE hostname = ? AND isactive = 1" Set rsLookup = ExecuteParameterizedQuery(objConn, strLookupSQL, Array(hostname)) IF NOT rsLookup.EOF THEN pcid = rsLookup("machineid") END IF rsLookup.Close Set rsLookup = Nothing END IF ELSE ' We have a machineid, but it might actually be a machine number ' Try to look it up as a machineid first Dim rsCheck strLookupSQL = "SELECT machineid FROM machines WHERE machineid = ? AND isactive = 1" Set rsCheck = ExecuteParameterizedQuery(objConn, strLookupSQL, Array(machineid)) ' If no machine found with that machineid, try treating it as a machine number IF rsCheck.EOF THEN rsCheck.Close strLookupSQL = "SELECT machineid FROM machines WHERE hostname = ? AND isactive = 1" Set rsCheck = ExecuteParameterizedQuery(objConn, strLookupSQL, Array(CStr(machineid))) IF NOT rsCheck.EOF THEN machineid = rsCheck("machineid") ELSE machineid = 0 ' Not found END IF END IF rsCheck.Close Set rsCheck = Nothing END IF IF pcid = 0 THEN objConn.Close Response.Redirect("displaypcs.asp") Response.End END IF '============================================================================= ' SECURITY: Use parameterized query to prevent SQL injection ' PHASE 2: Removed pc and pc_network_interfaces tables (migrated to machines) ' NOTE: Use explicit column names to avoid wildcard conflicts between tables '============================================================================= ' Phase 2: Only query columns that actually exist in machines table strSQL = "SELECT machines.machineid, machines.machinenumber, machines.alias, machines.hostname, " & _ "machines.serialnumber, machines.machinenotes, machines.mapleft, machines.maptop, " & _ "machines.modelnumberid, machines.businessunitid, machines.printerid, machines.pctypeid, " & _ "machines.loggedinuser, machines.osid, machines.machinestatusid, " & _ "machines.controllertypeid, machines.controllerosid, machines.requires_manual_machine_config, " & _ "machines.lastupdated, machines.dateadded, " & _ "pctypes.pctype, pctypes.pctypeid, " & _ "models.modelnumber, models.image, models.modelnumberid, " & _ "businessunits.businessunit, businessunits.businessunitid, " & _ "functionalaccounts.functionalaccount, functionalaccounts.functionalaccountid, " & _ "vendors.vendor, vendors.vendorid, " & _ "printers.ipaddress AS printerip, printers.printerid AS printer_id, " & _ "printers.printercsfname, printers.printerwindowsname " & _ "FROM machines " & _ "INNER JOIN models ON machines.modelnumberid = models.modelnumberid " & _ "LEFT JOIN pctypes ON models.machinetypeid = pctypes.pctypeid " & _ "INNER JOIN businessunits ON machines.businessunitid = businessunits.businessunitid " & _ "LEFT JOIN functionalaccounts ON machinetypes.functionalaccountid = functionalaccounts.functionalaccountid " & _ "INNER JOIN vendors ON models.vendorid = vendors.vendorid " & _ "LEFT JOIN printers ON machines.printerid = printers.printerid " & _ "WHERE machines.machineid = " WHERE machines.machineid = " & CLng(machineid) CLng(pcid) WHERE machines.machineid = " & CLng(machineid) " AND machines.pctypeid IS NOT NULL Set rs = objConn.Execute(strSQL) ' Check if machine exists If rs.EOF Then rs.Close Set rs = Nothing objConn.Close Response.Redirect("displaypcs.asp") Response.End End If %>
" alt="Card image cap">
" alt="profile-image" class="profile">
<%=Server.HTMLEncode(rs("hostname") & "")%>
<%=Server.HTMLEncode(rs("vendor") & "")%>
<%=Server.HTMLEncode(rs("machinetype") & "")%>
<%' machinedescription column doesn't exist in Phase 2 schema %>

<%=Server.HTMLEncode(rs("machinenotes") & "")%>

Configuration

Location:

Vendor:

Model:

Function:

BU:

IP Address:

MAC Address:

Controlling PC:

Printer:

<% Dim machineNumVal, vendorValM, modelValM, machineTypeVal, buVal ' Get values and default to N/A if empty machineNumVal = rs("hostname") & "" If machineNumVal = "" Then machineNumVal = "N/A" vendorValM = rs("vendor") & "" If vendorValM = "" Then vendorValM = "N/A" modelValM = rs("modelnumber") & "" If modelValM = "" Then modelValM = "N/A" machineTypeVal = rs("machinetype") & "" If machineTypeVal = "" Then machineTypeVal = "N/A" buVal = rs("businessunit") & "" If buVal = "" Then buVal = "N/A" %>

<% If machineNumVal <> "N/A" Then %> <%=Server.HTMLEncode(machineNumVal)%> <% Else Response.Write("N/A") End If %>

<%=Server.HTMLEncode(vendorValM)%>

<%=Server.HTMLEncode(modelValM)%>

<%=Server.HTMLEncode(machineTypeVal)%>

<%=Server.HTMLEncode(buVal)%>

<% ' Get primary communication (IP and MAC) from communications table Dim rsPrimaryCom, strPrimaryComSQL, primaryIP, primaryMAC strPrimaryComSQL = "SELECT address, macaddress FROM communications WHERE machineid = ? AND isprimary = 1 AND isactive = 1 LIMIT 1" Set rsPrimaryCom = ExecuteParameterizedQuery(objConn, strPrimaryComSQL, Array(machineid)) If Not rsPrimaryCom.EOF Then primaryIP = rsPrimaryCom("address") & "" primaryMAC = rsPrimaryCom("macaddress") & "" Else ' Try to get first active communication if no primary set rsPrimaryCom.Close strPrimaryComSQL = "SELECT address, macaddress FROM communications WHERE machineid = ? AND isactive = 1 ORDER BY comid LIMIT 1" Set rsPrimaryCom = ExecuteParameterizedQuery(objConn, strPrimaryComSQL, Array(machineid)) If Not rsPrimaryCom.EOF Then primaryIP = rsPrimaryCom("address") & "" primaryMAC = rsPrimaryCom("macaddress") & "" Else primaryIP = "" primaryMAC = "" End If End If rsPrimaryCom.Close Set rsPrimaryCom = Nothing ' Display IP Address If primaryIP <> "" Then Response.Write("

" & Server.HTMLEncode(primaryIP) & "

") Else Response.Write("

N/A

") End If ' Display MAC Address If primaryMAC <> "" Then Response.Write("

" & Server.HTMLEncode(primaryMAC) & "

") Else Response.Write("

N/A

") End If ' Get controlling PC from relationships Dim rsControlPC, strControlPCSQL, controlPCHostname, controlPCID strControlPCSQL = "SELECT m.machineid, m.hostname, m.machinenumber FROM machinerelationships mr " & _ "JOIN relationshiptypes rt ON mr.relationshiptypeid = rt.relationshiptypeid " & _ "JOIN machines m ON mr.machineid = m.machineid " & _ "WHERE mr.related_machineid = ? AND rt.relationshiptype = 'Controls' AND mr.isactive = 1 LIMIT 1" Set rsControlPC = ExecuteParameterizedQuery(objConn, strControlPCSQL, Array(machineid)) If Not rsControlPC.EOF Then controlPCHostname = rsControlPC("hostname") & "" controlPCID = rsControlPC("machineid") If controlPCHostname = "" Then controlPCHostname = rsControlPC("hostname") & "" Response.Write("

" & Server.HTMLEncode(controlPCHostname) & "

") Else Response.Write("

N/A

") End If rsControlPC.Close Set rsControlPC = Nothing ' SECURITY: HTML encode printer data to prevent XSS ' Printer data - check if exists (LEFT JOIN may return NULL) If Not IsNull(rs("printerid")) And rs("printerid") <> "" Then Dim printerNameVal printerNameVal = rs("printerwindowsname") & "" If printerNameVal = "" Then printerNameVal = "Printer #" & rs("printerid") Response.Write("

" & Server.HTMLEncode(printerNameVal) & "

") Else Response.Write("

N/A

") End If %>
Network Communications
<% ' Query communications for this machine strSQL2 = "SELECT c.*, ct.typename FROM communications c " & _ "JOIN comstypes ct ON c.comstypeid = ct.comstypeid " & _ "WHERE c.machineid = ? AND c.isactive = 1 ORDER BY c.isprimary DESC, c.comid ASC" Set rs2 = ExecuteParameterizedQuery(objConn, strSQL2, Array(machineid)) If rs2.EOF Then Response.Write("") Else Do While Not rs2.EOF Dim ipAddr, macAddr, ifaceName, isPrimary, statusBadge ipAddr = rs2("address") & "" macAddr = rs2("macaddress") & "" ifaceName = rs2("interfacename") & "" isPrimary = rs2("isprimary") If ipAddr = "" Then ipAddr = "N/A" If macAddr = "" Then macAddr = "N/A" If ifaceName = "" Then ifaceName = "N/A" If isPrimary Then statusBadge = "Primary" Else statusBadge = "" End If Response.Write("") Response.Write("") Response.Write("") Response.Write("") Response.Write("") Response.Write("") Response.Write("") Response.Write("") rs2.MoveNext Loop End If rs2.Close Set rs2 = Nothing %>
Type IP Address MAC Address Interface Primary Status
No network communications configured
" & Server.HTMLEncode(rs2("typename") & "") & "" & ipAddr & "" & macAddr & "" & ifaceName & "" & statusBadge & "Active
Machine Relationships
Controlled By PC
<% ' Query PCs that control this machine strSQL2 = "SELECT m.machineid, m.machinenumber, m.hostname, c.address, rt.relationshiptype " & _ "FROM machinerelationships mr " & _ "JOIN relationshiptypes rt ON mr.relationshiptypeid = rt.relationshiptypeid " & _ "JOIN machines m ON mr.machineid = m.machineid " & _ "LEFT JOIN communications c ON m.machineid = c.machineid AND c.isprimary = 1 " & _ "WHERE mr.related_machineid = ? AND rt.relationshiptype = 'Controls' AND mr.isactive = 1" Set rs2 = ExecuteParameterizedQuery(objConn, strSQL2, Array(machineid)) If rs2.EOF Then Response.Write("") Else Do While Not rs2.EOF Dim pcHostname, pcIP, pcMachineID pcHostname = rs2("hostname") & "" pcIP = rs2("address") & "" pcMachineID = rs2("machineid") If pcHostname = "" Then pcHostname = rs2("hostname") & "" If pcIP = "" Then pcIP = "N/A" Response.Write("") Response.Write("") Response.Write("") Response.Write("") Response.Write("") rs2.MoveNext Loop End If rs2.Close Set rs2 = Nothing %>
PC Hostname IP Address Relationship
No controlling PC assigned
" & Server.HTMLEncode(pcHostname) & "" & pcIP & "" & Server.HTMLEncode(rs2("relationshiptype") & "") & "
Dualpath / Redundant Machines
<% ' Query dualpath relationships strSQL2 = "SELECT m.machineid, m.machinenumber, mt.machinetype, mo.modelnumber, rt.relationshiptype " & _ "FROM machinerelationships mr " & _ "JOIN relationshiptypes rt ON mr.relationshiptypeid = rt.relationshiptypeid " & _ "JOIN machines m ON mr.related_machineid = m.machineid " & _ "LEFT JOIN models mo ON m.modelnumberid = mo.modelnumberid " & _ "LEFT JOIN pctypes mt ON mo.machinetypeid = mt.machinetypeid " & _ "WHERE mr.machineid = ? AND rt.relationshiptype = 'Dualpath' AND mr.isactive = 1" Set rs2 = ExecuteParameterizedQuery(objConn, strSQL2, Array(machineid)) If rs2.EOF Then Response.Write("") Else Do While Not rs2.EOF Dim dualMachineNum, dualType, dualModel, dualMachineID dualMachineNum = rs2("hostname") & "" dualType = rs2("machinetype") & "" dualModel = rs2("modelnumber") & "" dualMachineID = rs2("machineid") If dualType = "" Then dualType = "N/A" If dualModel = "" Then dualModel = "N/A" Response.Write("") Response.Write("") Response.Write("") Response.Write("") Response.Write("") Response.Write("") rs2.MoveNext Loop End If rs2.Close Set rs2 = Nothing %>
Machine Number Type Model Relationship
No dualpath relationships
" & Server.HTMLEncode(dualMachineNum) & "" & dualType & "" & dualModel & "" & Server.HTMLEncode(rs2("relationshiptype") & "") & "
Compliance & Security
<% ' Query compliance data strSQL2 = "SELECT * FROM compliance WHERE machineid = ?" Set rs2 = ExecuteParameterizedQuery(objConn, strSQL2, Array(machineid)) If Not rs2.EOF Then %>

Third Party Managed:

Third Party Manager:

OT Asset System:

DoD Asset Device Type:

Compliant:

<% Dim thirdPartyManaged, thirdPartyManager, otAssetSystem, dodAssetDeviceType, isCompliant thirdPartyManaged = rs2("is_third_party_managed") & "" thirdPartyManager = rs2("third_party_manager") & "" otAssetSystem = rs2("ot_asset_system") & "" dodAssetDeviceType = rs2("ot_asset_device_type") & "" isCompliant = rs2("is_compliant") ' Third party managed badge Dim tpmBadge If thirdPartyManaged = "Yes" Then tpmBadge = "Yes" ElseIf thirdPartyManaged = "No" Then tpmBadge = "No" Else tpmBadge = "N/A" End If %>

<%=tpmBadge%>

<%=Server.HTMLEncode(thirdPartyManager)%>

<%=Server.HTMLEncode(otAssetSystem)%>

<%=Server.HTMLEncode(dodAssetDeviceType)%>

<% If Not IsNull(isCompliant) Then If isCompliant Then Response.Write("Yes") Else Response.Write("No") End If Else Response.Write("Not Assessed") End If %>

Security Scans
<% rs2.Close Set rs2 = Nothing ' Query security scans strSQL2 = "SELECT * FROM compliancescans WHERE machineid = ? ORDER BY scan_date DESC LIMIT 10" Set rs2 = ExecuteParameterizedQuery(objConn, strSQL2, Array(machineid)) If rs2.EOF Then Response.Write("") Else Do While Not rs2.EOF Dim scanName, scanDate, scanResult, scanDetails, resultBadge scanName = rs2("scan_name") & "" scanDate = rs2("scan_date") & "" scanResult = rs2("scan_result") & "" scanDetails = rs2("scan_details") & "" If scanName = "" Then scanName = "Security Scan" If scanDetails = "" Then scanDetails = "No details" ' Result badge Select Case LCase(scanResult) Case "pass" resultBadge = "Pass" Case "fail" resultBadge = "Fail" Case "warning" resultBadge = "Warning" Case Else resultBadge = "Info" End Select Response.Write("") Response.Write("") Response.Write("") Response.Write("") Response.Write("") Response.Write("") rs2.MoveNext Loop End If rs2.Close Set rs2 = Nothing %>
Scan Name Date Result Details
No security scans recorded
" & Server.HTMLEncode(scanName) & "" & Server.HTMLEncode(scanDate) & "" & resultBadge & "" & scanDetails & "
<% Else Response.Write("

No compliance data available for this machine.

") rs2.Close Set rs2 = Nothing End If %>
<% '============================================================================= ' SECURITY: Use parameterized query for installed applications '============================================================================= strSQL2 = "SELECT * FROM installedapps, applications WHERE installedapps.appid = applications.appid AND installedapps.isactive = 1 AND installedapps.machineid = ? ORDER BY appname ASC" Set rs2 = ExecuteParameterizedQuery(objConn, strSQL2, Array(machineid)) Do While Not rs2.EOF Response.Write("") rs2.MoveNext Loop rs2.Close Set rs2 = Nothing %>
" & Server.HTMLEncode(rs2("appname") & "") & "
Select Machine Location
Click on the map to select a location
<% '============================================================================= ' CLEANUP '============================================================================= objConn.Close %>