Changeset 1020

Timestamp:

07/18/08 22:48:10 (1 month ago)

Author:

laurentj

Message:

bug #572: bad sql syntax when using jDaoConditions with in/not operators. p=julien

Files:

branches/1.0.x/lib/jelix/CREDITS (modified) (1 diff)
branches/1.0.x/lib/jelix/dao/jDaoFactoryBase.class.php (modified) (5 diffs)
branches/1.0.x/lib/jelix/forms/jFormsCompiler.class.php (modified) (1 diff)
branches/1.0.x/lib/jelix/forms/jFormsControl.class.php (modified) (3 diffs)
trunk/lib/jelix/CREDITS (modified) (1 diff)
trunk/lib/jelix/dao/jDaoFactoryBase.class.php (modified) (6 diffs)

Legend:

: Unmodified
: Added
: Removed
: Modified
: Copied
: Moved

branches/1.0.x/lib/jelix/CREDITS

r1010	r1020
74	74	- form plugin create always a form with method post (#592)
75	75	- jDao: attribute groupby for method selectfirst (#447)
	76	- jDao: fixed bug with jDaoConditions and IN operator (#572)
76	77	- jZipCreator: empty dirs are not included in the archive (#570)
77	78	- jForms: fixed bugs in jforms.js based on Martus' report (#554)

branches/1.0.x/lib/jelix/dao/jDaoFactoryBase.class.php

r1006	r1020
8	8	* @copyright 2005-2007 Laurent Jouanneau
9	9	* @copyright 2007 Loic Mathaud
10		* @copyright 2007 Julien Issler
	10	* @copyright 2007-2008 Julien Issler
11	11	* @link http://www.jelix.org
12	12	* @licence http://www.gnu.org/licenses/lgpl.html GNU Lesser General Public Licence, see LICENCE file
…	…
362	362	$prefixNoCondition = $prop['fieldName'];
363	363
364		$prefix = $prefixNoCondition.' '.$cond['operator'].' '; // ' ' for LIKE..
365
366		if (!is_array ($cond['value'])){
367		$value = $this->_prepareValue($cond['value'],$prop['datatype']);
	364	$op = strtoupper($cond['operator']);
	365	$prefix = $prefixNoCondition.' '.$op.' '; // ' ' for LIKE..
	366
	367	if ($op == 'IN' \|\| $op == 'NOT IN') {
	368	if (is_array($cond['value'])) {
	369	$values = array();
	370	foreach($cond['value'] as $value)
	371	$values[] = $this->_prepareValue($value, $prop['datatype']);
	372	$values = join(',', $values);
	373	}
	374	else
	375	$values = $cond['value'];
	376
	377	$r .= $prefix.'('.$values.')';
	378	}
	379	else if (!is_array ($cond['value'])){
	380	$value = $this->_prepareValue($cond['value'], $prop['datatype']);
368	381	if ($value === 'NULL'){
369		if($~~cond['operator']~~ == '='){
	382	if($op == '='){
370	383	$r .= $prefixNoCondition.' IS NULL';
371	384	}else{
…	…
375	388	$r .= $prefix.$value;
376	389	}
377		}~~else~~{
	390	} else {
378	391	$r .= ' ( ';
379	392	$firstCV = true;
…	…
382	395	$r .= ' or ';
383	396	}
384		$value = $this->_prepareValue($conditionValue,$prop['datatype']);
	397	$value = $this->_prepareValue($conditionValue, $prop['datatype']);
385	398	if ($value === 'NULL'){
386		if($~~cond['operator']~~ == '='){
	399	if($op == '='){
387	400	$r .= $prefixNoCondition.' IS NULL';
388	401	}else{
…	…
402	415	$r .= ' '.$condition->glueOp.' ';
403	416	}else{
404		$notfirst=true;
	417	$notfirst = true;
405	418	}
406	419	$r .= $this->_generateCondition($conditionDetail, $fields, $forSelect, false);

branches/1.0.x/lib/jelix/forms/jFormsCompiler.class.php

r968	r1020
244	244	$hasSelectedValues = true;
245	245	}elseif(isset($control['selectedvalue'])){
246		$source[]='$ctrl->defaultValue=array(\''. str_replace("'","\\'", (string)$control['selectedvalue']) .'\');';
	246	if ($controltype == 'menulist' \|\| $controltype == 'radiobuttons') {
	247	$source[]='$ctrl->defaultValue=\''. str_replace("'","\\'", (string)$control['selectedvalue']) .'\';';
	248	} else {
	249	$source[]='$ctrl->defaultValue=array(\''. str_replace("'","\\'", (string)$control['selectedvalue']) .'\');';
	250	}
247	251	$hasSelectedValues = true;
248	252	}

branches/1.0.x/lib/jelix/forms/jFormsControl.class.php

r790	r1020
133	133	class jFormsControlRadiobuttons extends jFormsControlDatasource {
134	134	public $type="radiobuttons";
	135	public $defaultValue='';
135	136	}
136	137
…	…
181	182	class jFormsControlMenulist extends jFormsControlDatasource {
182	183	public $type="menulist";
	184	public $defaultValue='';
183	185	}
184	186
…	…
311	313	}
312	314
313
314	315	?>

trunk/lib/jelix/CREDITS

r1016	r1020
22	22	- form plugin create always a form with method post (#592)
23	23	- jDao: attribute groupby for method selectfirst (#447)
	24	- jDao: fixed bug with jDaoConditions and IN operator (#572)
24	25	- jZipCreator: empty dirs are not included in the archive (#570)
25	26	- jForms: fixed bugs in jforms.js based on Martus' report (#554)

trunk/lib/jelix/dao/jDaoFactoryBase.class.php

r1015	r1020
8	8	* @copyright 2005-2007 Laurent Jouanneau
9	9	* @copyright 2007 Loic Mathaud
10		* @copyright 2007 Julien Issler
	10	* @copyright 2007-2008 Julien Issler
11	11	* @copyright 2008 Thomas
12	12	* @link http://www.jelix.org
…	…
272	272	$count = 'DISTINCT '.$this->_tables[$props[$distinct]['table']]['realname'].'.'.$props[$distinct]['fieldName'];
273	273	}
274
	274
275	275	$query = 'SELECT COUNT('.$count.') as c '.$this->_fromClause.$this->_whereClause;
276	276	if ($searchcond->hasConditions ()){
…	…
362	362	}
363	363	}
364
	364
365	365	if (count ($group)) {
366	366	return ' GROUP BY '.implode(', ', $group);
…	…
368	368	return '';
369	369	}
370
	370
371	371	/**
372	372	* @internal it don't support isExpr property of a condition because of security issue (SQL injection)
…	…
389	389	$prefixNoCondition = $prop['fieldName'];
390	390
391		$prefix = $prefixNoCondition.' '.$cond['operator'].' '; // ' ' for LIKE..
392
393		if (!is_array ($cond['value'])){
	391	$op = strtoupper($cond['operator']);
	392	$prefix = $prefixNoCondition.' '.$op.' '; // ' ' for LIKE..
	393
	394	if ($op == 'IN' \|\| $op == 'NOT IN'){
	395	if(is_array($cond['value'])){
	396	$values = array();
	397	foreach($cond['value'] as $value)
	398	$values[] = $this->_prepareValue($value,$prop['datatype']);
	399	$values = join(',', $values);
	400	}
	401	else
	402	$values = $cond['value'];
	403
	404	$r .= $prefix.'('.$values.')';
	405	}
	406	else if (!is_array ($cond['value'])){
394	407	$value = $this->_prepareValue($cond['value'],$prop['datatype']);
395	408	if ($value === 'NULL'){
396		if($~~cond['operator']~~ == '='){
	409	if($op == '='){
397	410	$r .= $prefixNoCondition.' IS NULL';
398	411	}else{
…	…
411	424	$value = $this->_prepareValue($conditionValue,$prop['datatype']);
412	425	if ($value === 'NULL'){
413		if($~~cond['operator']~~ == '='){
	426	if($op == '='){
414	427	$r .= $prefixNoCondition.' IS NULL';
415	428	}else{

Download in other formats: Unified Diff Zip Archive

Developers' Corner