chamilo
/
chamilo-lms
mirror of https://github.com/chamilo/chamilo-lms/tree/1.11.x
2
0
Fork 0
Code Issues Projects Releases Wiki Activity

[svn r22357] Adding intval and escape_string function see FS#4389

Browse Source
skala
Julio Montoya 16 years ago
parent 0ac05cc0f0
commit 8c476621ab
8 changed files with 60 additions and 72 deletions
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Show Stats Download Patch File Download Diff File
  1. 2
      main/admin/access_url_add_sessions_to_url.php
  2. 2
      main/admin/access_url_add_users_to_url.php
  3. 1
      main/admin/access_url_edit_courses_to_url.php
  4. 1
      main/admin/access_url_edit_sessions_to_url.php
  5. 1
      main/admin/access_url_edit_users_to_url.php
  6. 10
      main/forum/forumfunction.inc.php
  7. 74
      main/reservation/rsys.php
  8. 41
      main/work/work.lib.php

2
main/admin/access_url_add_sessions_to_url.php
Unescape View File

@ -123,7 +123,7 @@ if(empty($first_letter_user)) {
unset($result);
}
*/
$first_letter_session = Database::escape_string($first_letter_session);
$sql = "SELECT id, name FROM $tbl_session
WHERE name LIKE '".$first_letter_session."%' OR name LIKE '".strtolower($first_letter_session)."%'
ORDER BY name DESC ";

2
main/admin/access_url_add_users_to_url.php
Unescape View File

@ -127,6 +127,8 @@ if(empty($first_letter_user)) {
}
unset($result);
}
$first_letter_user = Database::escape_string($first_letter_user);
$sql = "SELECT user_id,lastname,firstname,username FROM $tbl_user
WHERE lastname LIKE '".$first_letter_user."%' OR lastname LIKE '".strtolower($first_letter_user)."%'
ORDER BY ". (count($users) > 0 ? "(user_id IN(".implode(',', $users).")) DESC," : "")." lastname";

1
main/admin/access_url_edit_courses_to_url.php
Unescape View File

@ -80,6 +80,7 @@ function search_courses($needle, $id)
// xajax send utf8 datas... datas in db can be non-utf8 datas
$charset = api_get_setting('platform_charset');
$needle = api_convert_encoding($needle, $charset, 'utf-8');
$needle = Database::escape_string($needle);
// search courses where username or firstname or lastname begins likes $needle
$sql = 'SELECT code, title FROM '.$tbl_course.' u
WHERE (title LIKE "'.$needle.'%"

1
main/admin/access_url_edit_sessions_to_url.php
Unescape View File

@ -79,6 +79,7 @@ function search_sessions($needle, $id)
// xajax send utf8 datas... datas in db can be non-utf8 datas
$charset = api_get_setting('platform_charset');
$needle = api_convert_encoding($needle, $charset, 'utf-8');
$needle = Database::escape_string($needle);
// search sessiones where username or firstname or lastname begins likes $needle
$sql = 'SELECT id, name FROM '.$tbl_session.' u
WHERE (name LIKE "'.$needle.'%")

1
main/admin/access_url_edit_users_to_url.php
Unescape View File

@ -79,6 +79,7 @@ function search_users($needle, $id)
// xajax send utf8 datas... datas in db can be non-utf8 datas
$charset = api_get_setting('platform_charset');
$needle = api_convert_encoding($needle, $charset, 'utf-8');
$needle = Database::escape_string($needle);
// search users where username or firstname or lastname begins likes $needle
$sql = 'SELECT u.user_id, username, lastname, firstname FROM '.$tbl_user.' u
WHERE (username LIKE "'.$needle.'%"

10
main/forum/forumfunction.inc.php
Unescape View File

@ -49,18 +49,13 @@
* @todo complete the missing phpdoc the correct order should be
*
* some explanation of the function
*
* @param
* @return
*
@todo
*
* @todo
* @author firstname lastname <email>, organisation
* @version (day) month year
*
* @deprecated
*/
/**
**************************************************************************
* IMPORTANT NOTICE
@ -413,7 +408,7 @@ function show_add_forum_form($inputvalues=array()) {
function delete_forum_image($forum_id)
{
$table_forums = Database::get_course_table(TABLE_FORUM);
echo '<br />';
$forum_id = Database::escape_string($forum_id);
$sql="SELECT forum_image FROM $table_forums WHERE forum_id = '".$forum_id."' ";
$result=api_sql_query($sql,__FILE__,__LINE__);
$row=Database::fetch_array($result);
@ -3429,6 +3424,7 @@ function edit_forum_attachment_file($file_comment,$post_id,$id_attach) {
function get_attachment($post_id) {
global $forum_table_attachment;
$row=array();
$post_id = intval($post_id);
$sql = 'SELECT id, path, filename,comment FROM '. $forum_table_attachment.' WHERE post_id ="'.$post_id.'"';
$result=api_sql_query($sql, __FILE__, __LINE__);
if (Database::num_rows($result)!=0) {

74
main/reservation/rsys.php
Unescape View File

@ -442,6 +442,7 @@ class Rsys {
* @return - Array The returned rows
*/
function get_item($id = null, $orderby = "name ASC") {
$id = Database::escape_string($id);
$sql = "SELECT i.* FROM ".Rsys :: getTable("item")." i";
if (!empty ($id)) {
if (!Rsys :: item_allow($id, 'view'))
@ -546,22 +547,7 @@ class Rsys {
WHERE ( 1=". (api_is_platform_admin() ? 1 : 0)."
OR ((cu.user_id='".api_get_user_id()."' AND (ir.edit_right=1 OR ir.delete_right=1)) OR i.creator='".api_get_user_id()."' ))";
//if (!empty ($_GET['cat']) && $_GET['cat'] <> 0) {
// $sql .= " AND ca.id = '".$_GET['cat']."' ";
//}
/*$sql .= " LEFT JOIN ".Rsys :: getTable("item_rights")." ir ON ir.item_id=i.id
LEFT JOIN ".Database :: get_main_table(TABLE_MAIN_CLASS)." c ON ir.class_id=c.id AND ir.item_id = i.id
LEFT JOIN ".Database :: get_main_table(TABLE_MAIN_CLASS_USER)." cu ON cu.class_id = c.id
WHERE ((cu.user_id='".api_get_user_id()."' AND (ir.edit_right=1 OR ir.delete_right=1)) OR i.creator='".api_get_user_id()."' OR 1=". (api_is_platform_admin() ? 1 : 0).")";
if (isset ($_GET['keyword']) != 0) {
$keyword = Database::escape_string($_GET['keyword']);
$sql .= " WHERE i.category_id LIKE '%".$keyword."%'";
}*/
//$sql .= " GROUP BY i.id";
return @ Database::result(api_sql_query($sql, __FILE__, __LINE__), 0, 0);
return @ Database::result(api_sql_query($sql, __FILE__, __LINE__), 0, 0);
}
/**
@ -636,7 +622,6 @@ class Rsys {
$class_id = Database::escape_string($class_id);
$value = Database::escape_string($value);
$column = Database::escape_string($column);
$sql = "SELECT item_id FROM ".Rsys :: getTable("item_rights")."WHERE item_id=".$item_id." AND class_id=".$class_id;
$result = api_sql_query($sql, __FILE__, __LINE__);
@ -668,7 +653,8 @@ class Rsys {
*/
function get_itemfiltered_class($item_id) {
$item_id = Database::escape_string($item_id);
$sql = "SELECT * FROM ".Database :: get_main_table(TABLE_MAIN_CLASS)." WHERE id NOT IN (SELECT class_id FROM ".Rsys :: getTable("item_rights")." WHERE item_id='".$item_id."') ORDER BY name ASC, code ASC";
$sql = "SELECT * FROM ".Database :: get_main_table(TABLE_MAIN_CLASS)."
WHERE id NOT IN (SELECT class_id FROM ".Rsys :: getTable("item_rights")." WHERE item_id='".$item_id."') ORDER BY name ASC, code ASC";
$arr = api_store_result(api_sql_query($sql, __FILE__, __LINE__));
return $arr;
}
@ -944,13 +930,13 @@ class Rsys {
function get_cat_items($category) {
$category = Database::escape_string($category);
$sql = "SELECT i.id,i.name as catitem
FROM ".Rsys :: getTable('item')." i
INNER JOIN ".Rsys :: getTable('category')." cat ON cat.id=i.category_id
LEFT JOIN ".Rsys :: getTable('item_rights')." ir ON ir.item_id=i.id
LEFT JOIN ".Database :: get_main_table(TABLE_MAIN_CLASS)." c ON ir.class_id=c.id AND ir.item_id = i.id
LEFT JOIN ".Database :: get_main_table(TABLE_MAIN_CLASS_USER)." cu ON cu.class_id = c.id
WHERE ((cu.user_id='".api_get_user_id()."' AND ir.view_right=1 ) OR i.creator='".api_get_user_id()."' OR 1=". (api_is_platform_admin() ? 1 : 0).") AND (category_id =".$category.")
ORDER BY cat.name ASC, i.name ASC";
FROM ".Rsys :: getTable('item')." i
INNER JOIN ".Rsys :: getTable('category')." cat ON cat.id=i.category_id
LEFT JOIN ".Rsys :: getTable('item_rights')." ir ON ir.item_id=i.id
LEFT JOIN ".Database :: get_main_table(TABLE_MAIN_CLASS)." c ON ir.class_id=c.id AND ir.item_id = i.id
LEFT JOIN ".Database :: get_main_table(TABLE_MAIN_CLASS_USER)." cu ON cu.class_id = c.id
WHERE ((cu.user_id='".api_get_user_id()."' AND ir.view_right=1 ) OR i.creator='".api_get_user_id()."' OR 1=". (api_is_platform_admin() ? 1 : 0).") AND (category_id =".$category.")
ORDER BY cat.name ASC, i.name ASC";
$result = api_sql_query($sql, __FILE__, __LINE__);
while ($array = Database::fetch_array($result))
$arr[$array['id']] = $array['catitem'];
@ -968,13 +954,13 @@ class Rsys {
*/
function get_table_reservations($from, $per_page, $column, $direction) {
$sql = "SELECT DISTINCT r.id AS col0, i.name AS col1, DATE_FORMAT(r.start_at,'%Y-%m-%d %H:%i') AS col2, DATE_FORMAT(r.end_at,'%Y-%m-%d %H:%i') AS col3," .
" DATE_FORMAT(r.subscribe_from,'%Y-%m-%d %k:%i') AS col4, DATE_FORMAT(r.subscribe_until,'%Y-%m-%d %k:%i') AS col5,IF(timepicker <> 0, '".get_lang('TimePicker')."',CONCAT(r.subscribers,'/',r.max_users)) AS col6, r.notes AS col7, r.id as col8
FROM ".Rsys :: getTable('reservation')." r
INNER JOIN ".Rsys :: getTable('item')." i ON r.item_id=i.id
LEFT JOIN ".Rsys :: getTable('item_rights')." ir ON ir.item_id=i.id
LEFT JOIN ".Database :: get_main_table(TABLE_MAIN_CLASS)." c ON ir.class_id=c.id AND ir.item_id = i.id
LEFT JOIN ".Database :: get_main_table(TABLE_MAIN_CLASS_USER)." cu ON cu.class_id = c.id
WHERE ((ir.m_reservation=1 AND cu.user_id='".api_get_user_id()."') OR i.creator='".api_get_user_id()."' OR 1=". (api_is_platform_admin() ? 1 : 0).")";
"DATE_FORMAT(r.subscribe_from,'%Y-%m-%d %k:%i') AS col4, DATE_FORMAT(r.subscribe_until,'%Y-%m-%d %k:%i') AS col5,IF(timepicker <> 0, '".get_lang('TimePicker')."',CONCAT(r.subscribers,'/',r.max_users)) AS col6, r.notes AS col7, r.id as col8
FROM ".Rsys :: getTable('reservation')." r
INNER JOIN ".Rsys :: getTable('item')." i ON r.item_id=i.id
LEFT JOIN ".Rsys :: getTable('item_rights')." ir ON ir.item_id=i.id
LEFT JOIN ".Database :: get_main_table(TABLE_MAIN_CLASS)." c ON ir.class_id=c.id AND ir.item_id = i.id
LEFT JOIN ".Database :: get_main_table(TABLE_MAIN_CLASS_USER)." cu ON cu.class_id = c.id
WHERE ((ir.m_reservation=1 AND cu.user_id='".api_get_user_id()."') OR i.creator='".api_get_user_id()."' OR 1=". (api_is_platform_admin() ? 1 : 0).")";
if (isset ($_GET['keyword'])) {
$keyword = Database::escape_string($_GET['keyword']);
$sql .= "AND (i.name LIKE '%".$keyword."%' OR i.description LIKE '%".$keyword."%' OR r.notes LIKE '%".$keyword."%')";
@ -1172,10 +1158,10 @@ class Rsys {
$result2 = api_sql_query($sql, __FILE__, __LINE__);
while ($arr = Database::fetch_array($result2, 'NUM')) {
$sql = "SELECT s.dummy, s.user_id, i.name, r.start_at, r.end_at
FROM ".Rsys :: getTable("subscription")." s
INNER JOIN ".Rsys :: getTable("reservation")." r ON s.reservation_id = r.id
INNER JOIN ".Rsys :: getTable("item")." i ON r.item_id = i.id
WHERE s.reservation_id='".$arr[0]."'";
FROM ".Rsys :: getTable("subscription")." s
INNER JOIN ".Rsys :: getTable("reservation")." r ON s.reservation_id = r.id
INNER JOIN ".Rsys :: getTable("item")." i ON r.item_id = i.id
WHERE s.reservation_id='".$arr[0]."'";
$result = api_sql_query($sql, __FILE__, __LINE__);
while ($array = Database::fetch_array($result, 'NUM')) {
$user_info = api_get_user_info($array[1]);
@ -1314,7 +1300,7 @@ class Rsys {
function get_num_waiting_users() {
$sql = "SELECT COUNT(DISTINCT dummy) FROM ".Rsys :: getTable('subscription');
if (isset ($_GET['rid'])) {
$sql .= " WHERE reservation_id = '".$_GET['rid']."'";
$sql .= " WHERE reservation_id = '".intval($_GET['rid'])."'";
}
return Database::result(api_sql_query($sql, __FILE__, __LINE__), 0, 0);
}
@ -1401,9 +1387,9 @@ class Rsys {
api_sql_query($sql, __FILE__, __LINE__);
$user_info = api_get_user_info($subscription[0]);
$sql = "SELECT name FROM ".Rsys :: getTable('subscription')." s
INNER JOIN ".Rsys :: getTable('reservation')." r ON s.reservation_id = r.id
INNER JOIN ".Rsys :: getTable('item')." i ON r.item_id = i.id
WHERE dummy='".$id."'";
INNER JOIN ".Rsys :: getTable('reservation')." r ON s.reservation_id = r.id
INNER JOIN ".Rsys :: getTable('item')." i ON r.item_id = i.id
WHERE dummy='".$id."'";
$items = api_sql_query($sql, __FILE__, __LINE__);
$item = Database::fetch_array($items);
$item_name = $item[0];
@ -1537,10 +1523,10 @@ class Rsys {
$sql = "UPDATE ".Rsys :: getTable("reservation")." SET subscribers=subscribers+1 WHERE id='".$reservation_id."'";
api_sql_query($sql, __FILE__, __LINE__);
$sql = "SELECT s.user_id, i.name, r.start_at, r.end_at
FROM ".Rsys :: getTable("subscription")." s
INNER JOIN ".Rsys :: getTable("reservation")." r ON s.reservation_id = r.id
INNER JOIN ".Rsys :: getTable("item")." i ON r.item_id = i.id
WHERE reservation_id='".$reservation_id."' AND user_id='".$user_id."'";
FROM ".Rsys :: getTable("subscription")." s
INNER JOIN ".Rsys :: getTable("reservation")." r ON s.reservation_id = r.id
INNER JOIN ".Rsys :: getTable("item")." i ON r.item_id = i.id
WHERE reservation_id='".$reservation_id."' AND user_id='".$user_id."'";
$result = api_store_result(api_sql_query($sql, __FILE__, __LINE__));
$user_info = api_get_user_info();
$titel = str_replace('#ITEM#', $result[0][1], get_lang("ReservationMadeTitle"));

41
main/work/work.lib.php
Unescape View File

@ -1,4 +1,4 @@
<?php //$Id: work.lib.php 21759 2009-07-03 09:57:09Z herodoto $
<?php //$Id: work.lib.php 22357 2009-07-24 17:44:17Z juliomontoya $
/* For licensing terms, see /dokeos_license.txt */
/**
* @package dokeos.work
@ -6,7 +6,7 @@
* @author Patrick Cool <patrick.cool@UGent.be>, Ghent University - ability for course admins to specify wether uploaded documents are visible or invisible by default.
* @author Roan Embrechts, code refactoring and virtual course support
* @author Frederic Vauthier, directories management
* @version $Id: work.lib.php 21759 2009-07-03 09:57:09Z herodoto $
* @version $Id: work.lib.php 22357 2009-07-24 17:44:17Z juliomontoya $
*/
/**
* Displays action links (for admins, authorized groups members and authorized students)
@ -1067,21 +1067,23 @@ function update_dir_name($path, $new_name) {
* @version April 2008
*/
function get_parent_directories($my_cur_dir_path)
{
$list_parents = explode('/', $my_cur_dir_path);
$dir_acum = '';
global $work_table;
$list_id=array();
for ($i = 0; $i < count($list_parents) - 1; $i++) {
$where_sentence = "url LIKE BINARY '" . $dir_acum . "/" . $list_parents[$i]."'";
$dir_acum .= '/' . $list_parents[$i];
$sql = "SELECT id FROM ". $work_table . " WHERE ". $where_sentence;
$result = api_sql_query($sql, __FILE__, __LINE__);
$row= Database::fetch_array($result);
$list_id[]=$row['id'];
}
return $list_id;
function get_parent_directories($my_cur_dir_path) {
$list_id = array();
if (!empty($my_cur_dir_path)) {
$list_parents = explode('/', $my_cur_dir_path);
$dir_acum = '';
global $work_table;
for ($i = 0; $i < count($list_parents) - 1; $i++) {
$item = Database::escape_string($list_parents[$i]);
$where_sentence = "url LIKE BINARY '" . $dir_acum . "/" . $item."'";
$dir_acum .= '/' . $list_parents[$i];
$sql = "SELECT id FROM ". $work_table . " WHERE ". $where_sentence;
$result = api_sql_query($sql, __FILE__, __LINE__);
$row= Database::fetch_array($result);
$list_id[]=$row['id'];
}
}
return $list_id;
}
/**
@ -1117,8 +1119,7 @@ function directory_to_array($directory)
* @version April 2008
*/
function insert_all_directory_in_course_table($base_work_dir)
{
function insert_all_directory_in_course_table($base_work_dir) {
$dir_to_array =directory_to_array($base_work_dir,true);
$only_dir=array();
@ -1135,7 +1136,7 @@ function insert_all_directory_in_course_table($base_work_dir)
active = '0',
accepted = '1',
filetype = 'folder',
post_group_id = '".$_GET['toolgroup']."',
post_group_id = '".intval($_GET['toolgroup'])."',
sent_date = '0000-00-00 00:00:00' ";
api_sql_query($sql_insert_all, __FILE__, __LINE__);
}

Write Preview
Loading…
Cancel
Save