chamilo
/
chamilo-lms
mirror of https://github.com/chamilo/chamilo-lms/tree/1.11.x
2
0
Fork 0
Code Issues Projects Releases Wiki Activity

Learnpath: Replace references to c_lp_item_view.id by c_lp_item_view.iid #dangerous - refs #2016

Browse Source
pull/2487/head
Yannick Warnier 8 years ago
parent 225fa08658
commit 57f63d63d6
2 changed files with 10 additions and 10 deletions
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Show Stats Download Patch File Download Diff File
  1. 14
      main/lp/learnpathItem.class.php
  2. 6
      main/lp/lp_view.php

14
main/lp/learnpathItem.class.php
Unescape View File

@ -612,7 +612,7 @@ class learnpathItem
if ($checkdb) { if ($checkdb) {
$tbl = Database::get_course_table(TABLE_LP_ITEM_VIEW); $tbl = Database::get_course_table(TABLE_LP_ITEM_VIEW);
$sql = "SELECT id FROM $tbl $sql = "SELECT iid FROM $tbl
WHERE WHERE
c_id = $course_id AND c_id = $course_id AND
lp_item_id = ".$this->db_id." AND lp_item_id = ".$this->db_id." AND
@ -3592,7 +3592,7 @@ class learnpathItem
if (is_array($this->objectives) && count($this->objectives) > 0) { if (is_array($this->objectives) && count($this->objectives) > 0) {
// Save objectives. // Save objectives.
$tbl = Database::get_course_table(TABLE_LP_ITEM_VIEW); $tbl = Database::get_course_table(TABLE_LP_ITEM_VIEW);
$sql = "SELECT id $sql = "SELECT iid
FROM $tbl FROM $tbl
WHERE WHERE
c_id = $course_id AND c_id = $course_id AND
@ -3614,7 +3614,7 @@ class learnpathItem
$iva_table = Database::get_course_table( $iva_table = Database::get_course_table(
TABLE_LP_IV_OBJECTIVE TABLE_LP_IV_OBJECTIVE
); );
$iva_sql = "SELECT id FROM $iva_table $iva_sql = "SELECT iid FROM $iva_table
WHERE WHERE
c_id = $course_id AND c_id = $course_id AND
lp_iv_id = $lp_iv_id AND lp_iv_id = $lp_iv_id AND
@ -3633,7 +3633,7 @@ class learnpathItem
"score_raw = '".Database::escape_string($objective[2])."',". "score_raw = '".Database::escape_string($objective[2])."',".
"score_min = '".Database::escape_string($objective[4])."',". "score_min = '".Database::escape_string($objective[4])."',".
"score_max = '".Database::escape_string($objective[3])."' ". "score_max = '".Database::escape_string($objective[3])."' ".
"WHERE c_id = $course_id AND id = $iva_id"; "WHERE c_id = $course_id AND iid = $iva_id";
Database::query($ivau_sql); Database::query($ivau_sql);
} else { } else {
// Insert new one. // Insert new one.
@ -3997,7 +3997,7 @@ class learnpathItem
) { ) {
// Save interactions. // Save interactions.
$tbl = Database::get_course_table(TABLE_LP_ITEM_VIEW); $tbl = Database::get_course_table(TABLE_LP_ITEM_VIEW);
$sql = "SELECT id FROM $tbl $sql = "SELECT iid FROM $tbl
WHERE WHERE
c_id = $course_id AND c_id = $course_id AND
lp_item_id = ".$this->db_id." AND lp_item_id = ".$this->db_id." AND
@ -4031,7 +4031,7 @@ class learnpathItem
); );
//also check for the interaction ID as it must be unique for this SCO view //also check for the interaction ID as it must be unique for this SCO view
$iva_sql = "SELECT id FROM $iva_table $iva_sql = "SELECT iid FROM $iva_table
WHERE WHERE
c_id = $course_id AND c_id = $course_id AND
lp_iv_id = $lp_iv_id AND lp_iv_id = $lp_iv_id AND
@ -4071,7 +4071,7 @@ class learnpathItem
$iva_table, $iva_table,
$params, $params,
array( array(
'c_id = ? AND id = ?' => array( 'c_id = ? AND iid = ?' => array(
$course_id, $course_id,
$iva_id $iva_id
) )

6
main/lp/lp_view.php
Unescape View File

@ -299,8 +299,8 @@ if (!empty($_REQUEST['exeId']) &&
$sql = "SELECT id FROM $TBL_LP_ITEM_VIEW $sql = "SELECT id FROM $TBL_LP_ITEM_VIEW
WHERE WHERE
c_id = $course_id AND c_id = $course_id AND
lp_item_id = '$safe_item_id' AND lp_item_id = $safe_item_id AND
lp_view_id = '".$_SESSION['oLP']->lp_view_id."' lp_view_id = ".$_SESSION['oLP']->lp_view_id."
ORDER BY id DESC ORDER BY id DESC
LIMIT 1"; LIMIT 1";
$res_last_attempt = Database::query($sql); $res_last_attempt = Database::query($sql);
@ -329,7 +329,7 @@ if (!empty($_REQUEST['exeId']) &&
status = '$status', status = '$status',
score = $score, score = $score,
total_time = $mytime total_time = $mytime
WHERE id='".$lp_item_view_id."' AND c_id = $course_id "; WHERE iid = $lp_item_view_id";
if ($debug) { if ($debug) {
error_log($sql); error_log($sql);

Write Preview
Loading…
Cancel
Save