From e61c9b866e187858393e52797b314011d42d7bc9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Elan=20Ruusam=C3=A4e?= Date: Thu, 9 May 2013 13:59:29 +0300 Subject: [PATCH] escape custom field columns properly this allows custom field values like "foo-bar", i.e not to create substraction expression. --- lib/eventum/class.search.php | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/lib/eventum/class.search.php b/lib/eventum/class.search.php index c6c8ef6..818b6bc 100644 --- a/lib/eventum/class.search.php +++ b/lib/eventum/class.search.php @@ -281,10 +281,10 @@ public static function getListing($prj_id, $options, $current_row = 0, $max = 5) if ($field['fld_type'] == 'multiple') { $search_value = Misc::escapeString($search_value); foreach ($search_value as $cfo_id) { - $stmt .= ",\n" . APP_DEFAULT_DB . "." . APP_TABLE_PREFIX . "issue_custom_field as cf" . $fld_id . '_' . $cfo_id . "\n"; + $stmt .= ",\n" . APP_DEFAULT_DB . "." . APP_TABLE_PREFIX . "issue_custom_field as `cf" . $fld_id . '_' . $cfo_id . "`\n"; } } else { - $stmt .= ",\n" . APP_DEFAULT_DB . "." . APP_TABLE_PREFIX . "issue_custom_field as cf" . $fld_id . "\n"; + $stmt .= ",\n" . APP_DEFAULT_DB . "." . APP_TABLE_PREFIX . "issue_custom_field as `cf" . $fld_id . "`\n"; } } } @@ -621,17 +621,17 @@ public static function buildWhereClause($options) $search_value = Misc::escapeString($search_value); foreach ($search_value as $cfo_id) { $cfo_id = Misc::escapeString($cfo_id); - $stmt .= " AND\n cf" . $fld_id . '_' . $cfo_id . ".icf_iss_id = iss_id"; - $stmt .= " AND\n cf" . $fld_id . '_' . $cfo_id . ".icf_fld_id = $fld_id"; - $stmt .= " AND\n cf" . $fld_id . '_' . $cfo_id . "." . $fld_db_name . " = '$cfo_id'"; + $stmt .= " AND\n `cf" . $fld_id . '_' . $cfo_id . "`.`icf_iss_id` = iss_id"; + $stmt .= " AND\n `cf" . $fld_id . '_' . $cfo_id . "`.`icf_fld_id` = $fld_id"; + $stmt .= " AND\n `cf" . $fld_id . '_' . $cfo_id . "`.`" . $fld_db_name . "` = '$cfo_id'"; } } elseif ($field['fld_type'] == 'date') { if ((empty($search_value['Year'])) || (empty($search_value['Month'])) || (empty($search_value['Day']))) { continue; } $search_value = $search_value['Year'] . "-" . $search_value['Month'] . "-" . $search_value['Day']; - $stmt .= " AND\n (iss_id = cf" . $fld_id . ".icf_iss_id AND - cf" . $fld_id . "." . $fld_db_name . " = '" . Misc::escapeString($search_value) . "')"; + $stmt .= " AND\n (iss_id = `cf" . $fld_id . "`.icf_iss_id AND + `cf" . $fld_id . "`.`" . $fld_db_name . "` = '" . Misc::escapeString($search_value) . "')"; } else if ($field['fld_type'] == 'integer') { $value = $search_value['value']; switch ($search_value['filter_type']) { @@ -651,16 +651,16 @@ public static function buildWhereClause($options) $cmp = '='; break; } - $stmt .= " AND\n (iss_id = cf" . $fld_id . ".icf_iss_id"; - $stmt .= " AND\n cf" . $fld_id . ".icf_fld_id = $fld_id"; + $stmt .= " AND\n (iss_id = `cf" . $fld_id . "`.icf_iss_id"; + $stmt .= " AND\n `cf" . $fld_id . "`.icf_fld_id = $fld_id"; $stmt .= " AND cf" . $fld_id . "." . $fld_db_name . $cmp . Misc::escapeString($value) . ')'; } else { - $stmt .= " AND\n (iss_id = cf" . $fld_id . ".icf_iss_id"; - $stmt .= " AND\n cf" . $fld_id . ".icf_fld_id = $fld_id"; + $stmt .= " AND\n (iss_id = `cf" . $fld_id . "`.icf_iss_id"; + $stmt .= " AND\n `cf" . $fld_id . "`.icf_fld_id = $fld_id"; if ($field['fld_type'] == 'combo') { - $stmt .= " AND cf" . $fld_id . "." . $fld_db_name . " IN(" . join(', ', Misc::escapeInteger($search_value)) . ")"; + $stmt .= " AND `cf" . $fld_id . "`.`" . $fld_db_name . "` IN(" . join(', ', Misc::escapeInteger($search_value)) . ")"; } else { - $stmt .= " AND cf" . $fld_id . "." . $fld_db_name . " LIKE '%" . Misc::escapeString($search_value) . "%'"; + $stmt .= " AND `cf" . $fld_id . "`.`" . $fld_db_name . "` LIKE '%" . Misc::escapeString($search_value) . "%'"; } $stmt .= ')'; } -- 1.8.4