Feature #347 - Course settings and Course creation, Documents, Dropbox tool: Removing the parameters __FILE__ and __LINE__ in the Database::query() calls.
$sql = "SELECT code,name FROM ".$table_course_category." WHERE auth_course_child ='TRUE' OR code = '".Database::escape_string($_course['categoryCode'])."' ORDER BY tree_pos";
$sql = "SELECT code,name FROM ".$table_course_category." WHERE auth_course_child ='TRUE' OR code = '".Database::escape_string($_course['categoryCode'])."' ORDER BY tree_pos";
$res = Database::query($sql, __FILE__, __LINE__);
$res = Database::query($sql);
$s_select_course_tutor_name="SELECT tutor_name FROM $tbl_course WHERE code='$course_code'";
$s_select_course_tutor_name="SELECT tutor_name FROM $tbl_course WHERE code='$course_code'";
$s_sql_course_titular="SELECT DISTINCT username, lastname, firstname FROM $tbl_user as user, $tbl_course_user as course_rel_user WHERE (course_rel_user.status='1') AND user.user_id=course_rel_user.user_id AND course_code='".$course_code."'";
$s_sql_course_titular="SELECT DISTINCT username, lastname, firstname FROM $tbl_user as user, $tbl_course_user as course_rel_user WHERE (course_rel_user.status='1') AND user.user_id=course_rel_user.user_id AND course_code='".$course_code."'";
$sql="SELECT username, lastname, firstname FROM $tbl_user as user, $tbl_admin as admin WHERE admin.user_id=user.user_id ORDER BY ".$target_name." ASC";
$sql="SELECT username, lastname, firstname FROM $tbl_user as user, $tbl_admin as admin WHERE admin.user_id=user.user_id ORDER BY ".$target_name." ASC";
$sql = "UPDATE $table_course_setting SET value = ".(int)$update_values['email_alert_to_teacher_on_new_user_in_course']." WHERE variable = 'email_alert_to_teacher_on_new_user_in_course' ";
$sql = "UPDATE $table_course_setting SET value = ".(int)$update_values['email_alert_to_teacher_on_new_user_in_course']." WHERE variable = 'email_alert_to_teacher_on_new_user_in_course' ";
$sql = "UPDATE $table_course_setting SET value = ".(int)$update_values['email_alert_manager_on_new_doc']." WHERE variable = 'email_alert_manager_on_new_doc' ";
$sql = "UPDATE $table_course_setting SET value = ".(int)$update_values['email_alert_manager_on_new_doc']." WHERE variable = 'email_alert_manager_on_new_doc' ";
$sql = "UPDATE $table_course_setting SET value = ".(int)$update_values['email_alert_on_new_doc_dropbox']." WHERE variable = 'email_alert_on_new_doc_dropbox' ";
$sql = "UPDATE $table_course_setting SET value = ".(int)$update_values['email_alert_on_new_doc_dropbox']." WHERE variable = 'email_alert_on_new_doc_dropbox' ";
$sql = "UPDATE $table_course_setting SET value = ".(int)$update_values['email_alert_manager_on_new_quiz']." WHERE variable = 'email_alert_manager_on_new_quiz' ";
$sql = "UPDATE $table_course_setting SET value = ".(int)$update_values['email_alert_manager_on_new_quiz']." WHERE variable = 'email_alert_manager_on_new_quiz' ";
$sql = "UPDATE $table_course_setting SET value = ".(int)$update_values['allow_user_edit_announcement']." WHERE variable = 'allow_user_edit_announcement' ";
$sql = "UPDATE $table_course_setting SET value = ".(int)$update_values['allow_user_edit_announcement']." WHERE variable = 'allow_user_edit_announcement' ";
$sql = "SELECT * FROM $table_properties WHERE TOOL = '".$tool."' AND ref='".$resource->get_id()."'";
$sql = "SELECT * FROM $table_properties WHERE TOOL = '".$tool."' AND ref='".$resource->get_id()."'";
$res = Database::query($sql,__FILE__,__LINE__);
$res = Database::query($sql);
$all_properties = array ();
$all_properties = array ();
while ($item_property = Database::fetch_array($res))
while ($item_property = Database::fetch_array($res))
{
{
@ -143,7 +143,7 @@ class CourseBuilder
$sql = 'SELECT * FROM '.$table_doc.' d, '.$table_prop.' p WHERE tool = \''.TOOL_DOCUMENT.'\' AND p.ref = d.id AND p.visibility != 2 AND session_id = '.$session_id.' ORDER BY path';
$sql = 'SELECT * FROM '.$table_doc.' d, '.$table_prop.' p WHERE tool = \''.TOOL_DOCUMENT.'\' AND p.ref = d.id AND p.visibility != 2 AND session_id = '.$session_id.' ORDER BY path';
$doc = new Document($obj->id, $obj->path, $obj->comment, $obj->title, $obj->filetype, $obj->size);
$doc = new Document($obj->id, $obj->path, $obj->comment, $obj->title, $obj->filetype, $obj->size);
@ -159,7 +159,7 @@ class CourseBuilder
else
else
$sql = 'SELECT * FROM '.$table_doc.' d, '.$table_prop.' p WHERE tool = \''.TOOL_DOCUMENT.'\' AND p.ref = d.id AND p.visibility != 2 AND d.session_id = 0 ORDER BY path';
$sql = 'SELECT * FROM '.$table_doc.' d, '.$table_prop.' p WHERE tool = \''.TOOL_DOCUMENT.'\' AND p.ref = d.id AND p.visibility != 2 AND d.session_id = 0 ORDER BY path';
$sql = "SELECT * FROM $table l, $table_prop p WHERE p.ref=l.id AND p.tool = '".TOOL_LINK."' AND p.visibility != 2 AND l.session_id = 0 ORDER BY l.display_order";
$sql = "SELECT * FROM $table l, $table_prop p WHERE p.ref=l.id AND p.tool = '".TOOL_LINK."' AND p.visibility != 2 AND l.session_id = 0 ORDER BY l.display_order";
$link_category = new LinkCategory($obj->id, $obj->category_title, $obj->description, $obj->display_order);
$link_category = new LinkCategory($obj->id, $obj->category_title, $obj->description, $obj->display_order);
@ -320,7 +320,7 @@ class CourseBuilder
$sql = 'SELECT * FROM '.$table_qui.' WHERE active >=0 AND session_id = 0'; //select only quizzes with active = 0 or 1 (not -1 which is for deleted quizzes)
$sql = 'SELECT * FROM '.$table_qui.' WHERE active >=0 AND session_id = 0'; //select only quizzes with active = 0 or 1 (not -1 which is for deleted quizzes)
$sql = "DELETE FROM ".$table_linked_resources." WHERE (source_type = '".$type."' AND source_id = '".$id."') OR (resource_type = '".$type."' AND resource_id = '".$id."') ";
$sql = "DELETE FROM ".$table_linked_resources." WHERE (source_type = '".$type."' AND source_id = '".$id."') OR (resource_type = '".$type."' AND resource_id = '".$id."') ";
Database::query($sql,__FILE__,__LINE__);
Database::query($sql);
if(is_numeric($id))
if(is_numeric($id))
{
{
$sql = "DELETE FROM ".$table_item_properties." WHERE tool ='".$resource->get_tool()."' AND ref=".$id;
$sql = "DELETE FROM ".$table_item_properties." WHERE tool ='".$resource->get_tool()."' AND ref=".$id;
Database::query($sql, __FILE__, __LINE__);
Database::query($sql);
}
}
elseif ($type == RESOURCE_TOOL_INTRO)
elseif ($type == RESOURCE_TOOL_INTRO)
{
{
$sql = "DELETE FROM $table_tool_intro WHERE id='$id'";
$sql = "DELETE FROM $table_tool_intro WHERE id='$id'";
$sql = "UPDATE ".$table." SET comment = '".Database::escape_string($document->comment)."', title='".Database::escape_string($document->title)."', size='".$document->size."' WHERE id = '".$obj->id."'";
$sql = "UPDATE ".$table." SET comment = '".Database::escape_string($document->comment)."', title='".Database::escape_string($document->title)."', size='".$document->size."' WHERE id = '".$obj->id."'";
Database::query($sql, __FILE__, __LINE__);
Database::query($sql);
break;
break;
case FILE_SKIP :
case FILE_SKIP :
$sql = "SELECT id FROM ".$table." WHERE path='/".Database::escape_string(substr($document->path, 9))."'";
$sql = "SELECT id FROM ".$table." WHERE path='/".Database::escape_string(substr($document->path, 9))."'";
foreach ($resources[RESOURCE_TOOL_INTRO] as $id => $tool_intro)
foreach ($resources[RESOURCE_TOOL_INTRO] as $id => $tool_intro)
{
{
$sql = "DELETE FROM ".$tool_intro_table." WHERE id='".Database::escape_string($tool_intro->id)."'";
$sql = "DELETE FROM ".$tool_intro_table." WHERE id='".Database::escape_string($tool_intro->id)."'";
Database::query($sql, __FILE__, __LINE__);
Database::query($sql);
$sql = "INSERT INTO ".$tool_intro_table." SET id='".Database::escape_string($tool_intro->id)."', intro_text = '".Database::escape_string($tool_intro->intro_text)."'";
$sql = "INSERT INTO ".$tool_intro_table." SET id='".Database::escape_string($tool_intro->id)."', intro_text = '".Database::escape_string($tool_intro->intro_text)."'";
$sql = "INSERT INTO ".$table_glossary." SET name = '".Database::escape_string($glossary->name)."', description = '".Database::escape_string($glossary->description)."', display_order='".Database::escape_string($glossary->display_order)."' $condition_session ";
$sql = "INSERT INTO ".$table_glossary." SET name = '".Database::escape_string($glossary->name)."', description = '".Database::escape_string($glossary->description)."', display_order='".Database::escape_string($glossary->display_order)."' $condition_session ";
$sql = 'SELECT * FROM '.$table_doc.' d, '.$table_prop.' p WHERE tool = \''.TOOL_DOCUMENT.'\' AND p.ref = d.id AND p.visibility != 2 AND id = '.$resource_item.$condition_session.' ORDER BY path';
$sql = 'SELECT * FROM '.$table_doc.' d, '.$table_prop.' p WHERE tool = \''.TOOL_DOCUMENT.'\' AND p.ref = d.id AND p.visibility != 2 AND id = '.$resource_item.$condition_session.' ORDER BY path';
@ -76,7 +76,7 @@ if ((isset ($_POST['action']) && $_POST['action'] == 'course_select_form') || (i
$sql .= ' AND cu.status=1 ';
$sql .= ' AND cu.status=1 ';
}
}
$sql .= ' AND target_course_code IS NULL AND cu.user_id = '.$user_info['user_id'].' AND c.code != '."'".$course_info['sysCode']."'".' ORDER BY title ASC';
$sql .= ' AND target_course_code IS NULL AND cu.user_id = '.$user_info['user_id'].' AND c.code != '."'".$course_info['sysCode']."'".' ORDER BY title ASC';
//search for all files that are not deleted => visibility != 2
//search for all files that are not deleted => visibility != 2
$query = Database::query("SELECT path FROM $doc_table AS docs,$prop_table AS props WHERE `props`.`tool`='".TOOL_DOCUMENT."' AND `docs`.`id`=`props`.`ref` AND `docs`.`path` LIKE '".$querypath."/%' AND `docs`.`filetype`='file' AND `props`.`visibility`<>'2' AND `props`.`to_group_id`=".$to_group_id."",__FILE__,__LINE__);
$query = Database::query("SELECT path FROM $doc_table AS docs,$prop_table AS props WHERE `props`.`tool`='".TOOL_DOCUMENT."' AND `docs`.`id`=`props`.`ref` AND `docs`.`path` LIKE '".$querypath."/%' AND `docs`.`filetype`='file' AND `props`.`visibility`<>'2' AND `props`.`to_group_id`=".$to_group_id."");
//add tem to the zip file
//add tem to the zip file
while ($not_deleted_file = Database::fetch_assoc($query))
while ($not_deleted_file = Database::fetch_assoc($query))
{
{
@ -102,7 +102,7 @@ else
//big problem: visible files that are in a hidden folder are included when we do a query for visiblity='v'!!!
//big problem: visible files that are in a hidden folder are included when we do a query for visiblity='v'!!!
//so... I do it in a couple of steps:
//so... I do it in a couple of steps:
//1st: get all files that are visible in the given path
//1st: get all files that are visible in the given path
$query = Database::query("SELECT path FROM $doc_table AS docs,$prop_table AS props WHERE `props`.`tool`='".TOOL_DOCUMENT."' AND `docs`.`id`=`props`.`ref` AND `docs`.`path` LIKE '".$querypath."/%' AND `props`.`visibility`='1' AND `docs`.`filetype`='file' AND `props`.`to_group_id`=".$to_group_id,__FILE__,__LINE__);
$query = Database::query("SELECT path FROM $doc_table AS docs,$prop_table AS props WHERE `props`.`tool`='".TOOL_DOCUMENT."' AND `docs`.`id`=`props`.`ref` AND `docs`.`path` LIKE '".$querypath."/%' AND `props`.`visibility`='1' AND `docs`.`filetype`='file' AND `props`.`to_group_id`=".$to_group_id);
//add them to an array
//add them to an array
while ($all_visible_files = Database::fetch_assoc($query))
while ($all_visible_files = Database::fetch_assoc($query))
{
{
@ -113,7 +113,7 @@ else
//print_r($all_visible_files_path);
//print_r($all_visible_files_path);
//echo('</pre>');
//echo('</pre>');
//2nd: get all folders that are invisible in the given path
//2nd: get all folders that are invisible in the given path
$query2 = Database::query("SELECT path FROM $doc_table AS docs,$prop_table AS props WHERE `props`.`tool`='".TOOL_DOCUMENT."' AND `docs`.`id`=`props`.`ref` AND `docs`.`path` LIKE '".$querypath."/%' AND `props`.`visibility`<>'1' AND `docs`.`filetype`='folder'",__FILE__,__LINE__);
$query2 = Database::query("SELECT path FROM $doc_table AS docs,$prop_table AS props WHERE `props`.`tool`='".TOOL_DOCUMENT."' AND `docs`.`id`=`props`.`ref` AND `docs`.`path` LIKE '".$querypath."/%' AND `props`.`visibility`<>'1' AND `docs`.`filetype`='folder'");
//if we get invisible folders, we have to filter out these results from all visible files we found
//if we get invisible folders, we have to filter out these results from all visible files we found
if(Database::num_rows($query2)>0)
if(Database::num_rows($query2)>0)
{
{
@ -122,7 +122,7 @@ else
{
{
//3rd: get all files that are in the found invisible folder (these are "invisible" too)
//3rd: get all files that are in the found invisible folder (these are "invisible" too)
$query3 = Database::query("SELECT path FROM $doc_table AS docs,$prop_table AS props WHERE `props`.`tool`='".TOOL_DOCUMENT."' AND `docs`.`id`=`props`.`ref` AND `docs`.`path` LIKE '".$invisible_folders['path']."/%' AND `docs`.`filetype`='file' AND `props`.`visibility`='1'",__FILE__,__LINE__);
$query3 = Database::query("SELECT path FROM $doc_table AS docs,$prop_table AS props WHERE `props`.`tool`='".TOOL_DOCUMENT."' AND `docs`.`id`=`props`.`ref` AND `docs`.`path` LIKE '".$invisible_folders['path']."/%' AND `docs`.`filetype`='file' AND `props`.`visibility`='1'");
//add tem to an array
//add tem to an array
while ($files_in_invisible_folder = Database::fetch_assoc($query3))
while ($files_in_invisible_folder = Database::fetch_assoc($query3))
@ -154,11 +154,11 @@ function delete_category($action, $id)
// step 1: delete the category
// step 1: delete the category
$sql="DELETE FROM ".$dropbox_cnf['tbl_category']." WHERE cat_id='".Database::escape_string($id)."' AND $sentreceived='1'";
$sql="DELETE FROM ".$dropbox_cnf['tbl_category']." WHERE cat_id='".Database::escape_string($id)."' AND $sentreceived='1'";
$result=Database::query($sql,__FILE__,__LINE__);
$result=Database::query($sql);
// step 2: delete all the documents in this category
// step 2: delete all the documents in this category
$sql="SELECT * FROM ".$entries_table." WHERE cat_id='".Database::escape_string($id)."'";
$sql="SELECT * FROM ".$entries_table." WHERE cat_id='".Database::escape_string($id)."'";
$result=Database::query($sql,__FILE__,__LINE__);
$result=Database::query($sql);
while ($row=Database::fetch_array($result))
while ($row=Database::fetch_array($result))
{
{
@ -244,7 +244,7 @@ function store_move($id, $target, $part)
WHERE dest_user_id='".Database::escape_string($_user['user_id'])."'
WHERE dest_user_id='".Database::escape_string($_user['user_id'])."'
AND file_id='".Database::escape_string($id)."'
AND file_id='".Database::escape_string($id)."'
";
";
Database::query($sql,__FILE__,__LINE__);
Database::query($sql);
$return_message=get_lang('ReceivedFileMoved');
$return_message=get_lang('ReceivedFileMoved');
}
}
if ($part=='sent')
if ($part=='sent')
@ -253,7 +253,7 @@ function store_move($id, $target, $part)
WHERE uploader_id='".Database::escape_string($_user['user_id'])."'
WHERE uploader_id='".Database::escape_string($_user['user_id'])."'
AND id='".Database::escape_string($id)."'
AND id='".Database::escape_string($id)."'
";
";
Database::query($sql,__FILE__,__LINE__);
Database::query($sql);
$return_message=get_lang('SentFileMoved');
$return_message=get_lang('SentFileMoved');
}
}
}
}
@ -343,7 +343,7 @@ function get_dropbox_categories($filter='')
$sql="SELECT * FROM ".$dropbox_cnf['tbl_category']." WHERE user_id='".$_user['user_id']."' $condition_session";
$sql="SELECT * FROM ".$dropbox_cnf['tbl_category']." WHERE user_id='".$_user['user_id']."' $condition_session";
$result=Database::query($sql,__FILE__,__LINE__);
$result=Database::query($sql);
while ($row=Database::fetch_array($result))
while ($row=Database::fetch_array($result))
{
{
if(($filter=='sent' AND $row['sent']==1) OR ($filter=='received' AND $row['received']==1) OR $filter=='')
if(($filter=='sent' AND $row['sent']==1) OR ($filter=='received' AND $row['received']==1) OR $filter=='')
@ -401,7 +401,7 @@ function store_addcategory()
$session_id = api_get_session_id();
$session_id = api_get_session_id();
// step 3a, we check if the category doesn't already exist
// step 3a, we check if the category doesn't already exist
$sql="SELECT * FROM ".$dropbox_cnf['tbl_category']." WHERE user_id='".$_user['user_id']."' AND cat_name='".Database::escape_string(Security::remove_XSS($_POST['category_name']))."' AND received='".$received."' AND sent='$sent' AND session_id='$session_id'";
$sql="SELECT * FROM ".$dropbox_cnf['tbl_category']." WHERE user_id='".$_user['user_id']."' AND cat_name='".Database::escape_string(Security::remove_XSS($_POST['category_name']))."' AND received='".$received."' AND sent='$sent' AND session_id='$session_id'";
$result=Database::query($sql,__FILE__,__LINE__);
$result=Database::query($sql);
// step 3b, we add the category if it does not exist yet.
// step 3b, we add the category if it does not exist yet.
@ -409,7 +409,7 @@ function store_addcategory()
{
{
$sql="INSERT INTO ".$dropbox_cnf['tbl_category']." (cat_name, received, sent, user_id, session_id)
$sql="INSERT INTO ".$dropbox_cnf['tbl_category']." (cat_name, received, sent, user_id, session_id)
@ -446,7 +446,7 @@ function display_addcategory_form($category_name='', $id='',$action)
{
{
// retrieve the category we are editing
// retrieve the category we are editing
$sql="SELECT * FROM ".$dropbox_cnf['tbl_category']." WHERE cat_id='".Database::escape_string($id)."'";
$sql="SELECT * FROM ".$dropbox_cnf['tbl_category']." WHERE cat_id='".Database::escape_string($id)."'";
$result=Database::query($sql,__FILE__,__LINE__);
$result=Database::query($sql);
$row=Database::fetch_array($result);
$row=Database::fetch_array($result);
if ($category_name=='') // after an edit with an error we do not want to return to the original name but the name we already modified. (happens when createinrecievedfiles AND createinsentfiles are not checked)
if ($category_name=='') // after an edit with an error we do not want to return to the original name but the name we already modified. (happens when createinrecievedfiles AND createinsentfiles are not checked)
@ -717,7 +717,7 @@ function getUserNameFromId ( $id) // RH: Mailing: return 'Mailing ' + id
$sql = "SELECT ".(api_is_western_name_order() ? "CONCAT(firstname,' ', lastname)" : "CONCAT(lastname,' ', firstname)")." AS name
$sql = "SELECT ".(api_is_western_name_order() ? "CONCAT(firstname,' ', lastname)" : "CONCAT(lastname,' ', firstname)")." AS name
Ivan Tcholakov
16 years ago