holm/egroupware
1
1
Fork 0
forked from extern/egroupware
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Appears to fix problems with bad data sent to a couple of functions, causing bad SQL generation

Browse Source
This commit is contained in:
Miles Lott 2004-01-02 22:49:10 +00:00
parent 6a5b4e957e
commit 5dbef396f9
1 changed files with 19 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
phpgwapi/inc/class.categories.inc.php
View File

@ -185,7 +185,7 @@
$querymethod .= ' AND last_mod > ' . $lastmod;
}
if ($column)
if($column)
{
switch($column)
{
@ -207,7 +207,7 @@
$table_column = ' * ';
}
$sql = "SELECT $table_column from phpgw_categories WHERE (cat_appname='" . $this->app_name . "' AND" . $grant_cats . $global_cats . ')'
$sql = "SELECT $table_column FROM phpgw_categories WHERE (cat_appname='" . $this->app_name . "' AND" . $grant_cats . $global_cats . ')'
. $parent_filter . $querymethod . $filter;
$this->db2->query($sql,__LINE__,__FILE__);
@ -309,7 +309,7 @@
$querymethod = " AND (cat_name LIKE '%$query%' OR cat_description LIKE '%$query%') ";
}
$sql = "SELECT * from phpgw_categories WHERE (cat_appname='" . $this->app_name . "' AND" . $grant_cats . $global_cats . ")"
$sql = "SELECT * FROM phpgw_categories WHERE (cat_appname='" . $this->app_name . "' AND" . $grant_cats . $global_cats . ")"
. $querymethod;
$this->db2->query($sql . $parent_select,__LINE__,__FILE__);
@ -644,13 +644,13 @@
}
$this->db->query('UPDATE phpgw_categories set cat_level=' . ($cats[$i]['level']-1) . $update_main . $update_parent
. ' WHERE cat_id=' . (int)$cats[$i]['id'] . " AND cat_appname='" . $this->app_name . "'",__LINE__,__FILE__);
. ' WHERE cat_id=' . (int)$cats[$i]['id'] . " AND cat_appname='" . $this->app_name . "'",__LINE__,__FILE__);
}
}
}
$this->db->query('DELETE FROM phpgw_categories WHERE cat_id=' . $cat_id . $subdelete . " AND cat_appname='"
. $this->app_name . "'",__LINE__,__FILE__);
. $this->app_name . "'",__LINE__,__FILE__);
}
/*!
@ -689,9 +689,9 @@
$values['name'] = $this->db->db_addslashes($values['name']);
$sql = "UPDATE phpgw_categories SET cat_name='" . $values['name'] . "', cat_description='" . $values['descr']
. "', cat_data='" . $values['data'] . "', cat_parent=" . $values['parent'] . ", cat_access='"
. $values['access'] . "', cat_main=" . $values['main'] . ', cat_level=' . $values['level'] . ',last_mod=' . time()
. " WHERE cat_appname='" . $this->app_name . "' AND cat_id=" . $values['id'];
. "', cat_data='" . $values['data'] . "', cat_parent=" . $values['parent'] . ", cat_access='"
. $values['access'] . "', cat_main=" . $values['main'] . ', cat_level=' . $values['level'] . ',last_mod=' . time()
. " WHERE cat_appname='" . $this->app_name . "' AND cat_id=" . $values['id'];
$this->db->query($sql,__LINE__,__FILE__);
return $values['id'];
@ -700,7 +700,7 @@
function name2id($cat_name)
{
$this->db->query("SELECT cat_id FROM phpgw_categories WHERE cat_name='" . $this->db->db_addslashes($cat_name) . "' "
."AND cat_appname='" . $this->app_name . "' AND (cat_owner=" . $this->account_id . ' OR cat_owner=-1)',__LINE__,__FILE__);
."AND cat_appname='" . $this->app_name . "' AND (cat_owner=" . $this->account_id . ' OR cat_owner=-1)',__LINE__,__FILE__);
if(!$this->db->num_rows())
{
@ -715,18 +715,18 @@
function id2name($cat_id = '', $item = 'name')
{
$cat_id = (int)$cat_id;
if ($cat_id == 0)
if($cat_id == 0)
{
return '--';
}
switch($item)
{
default: //fall through
case 'name': $value = 'cat_name'; break;
case 'owner': $value = 'cat_owner'; break;
case 'main': $value = 'cat_main'; break;
case 'level': $value = 'cat_level'; break;
case 'parent': $value = 'cat_parent'; break;
case 'name':
default: $value = 'cat_parent'; break;
}
$this->db->query("SELECT $value FROM phpgw_categories WHERE cat_id=" . $cat_id,__LINE__,__FILE__);