chamilo
/
chamilo-lms
mirror of https://github.com/chamilo/chamilo-lms/tree/1.11.x
2
0
Fork 0
Code Issues Projects Releases Wiki Activity

Minor - Using Database :: escape_string instead of this->escape_string

Browse Source
skala
Julio Montoya 12 years ago
parent a7391f005b
commit bd38dccabd
1 changed files with 37 additions and 38 deletions
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Show Stats Download Patch File Download Diff File
  1. 75
      main/newscorm/learnpath.class.php

75
main/newscorm/learnpath.class.php
Unescape View File

@ -100,7 +100,7 @@ class learnpath {
return false; return false;
} else { } else {
$main_table = Database::get_main_table(TABLE_MAIN_COURSE); $main_table = Database::get_main_table(TABLE_MAIN_COURSE);
$course = $this->escape_string($course); $course = Database::escape_string($course);
$sql = "SELECT * FROM $main_table WHERE code = '$course'"; $sql = "SELECT * FROM $main_table WHERE code = '$course'";
if ($this->debug > 2) { error_log('New LP - learnpath::__construct() '.__LINE__.' - Querying course: '.$sql, 0); } if ($this->debug > 2) { error_log('New LP - learnpath::__construct() '.__LINE__.' - Querying course: '.$sql, 0); }
$res = Database::query($sql); $res = Database::query($sql);
@ -377,14 +377,14 @@ class learnpath {
$parent = intval($parent); $parent = intval($parent);
$previous = intval($previous); $previous = intval($previous);
$type = $this->escape_string($type); $type = Database::escape_string($type);
$id = intval($id); $id = intval($id);
$max_time_allowed = $this->escape_string(htmlentities($max_time_allowed)); $max_time_allowed = Database::escape_string(htmlentities($max_time_allowed));
if (empty ($max_time_allowed)) { if (empty ($max_time_allowed)) {
$max_time_allowed = 0; $max_time_allowed = 0;
} }
$title = $this->escape_string($title); $title = Database::escape_string($title);
$description = $this->escape_string($description); $description = Database::escape_string($description);
$sql_count = " SELECT COUNT(id) AS num $sql_count = " SELECT COUNT(id) AS num
FROM $tbl_lp_item FROM $tbl_lp_item
WHERE c_id = $course_id AND lp_id = " . $this->get_id() . " AND parent_item_id = " . $parent; WHERE c_id = $course_id AND lp_id = " . $this->get_id() . " AND parent_item_id = " . $parent;
@ -428,7 +428,7 @@ class learnpath {
} }
$new_item_id = -1; $new_item_id = -1;
$id = $this->escape_string($id); $id = Database::escape_string($id);
if ($type == 'quiz') { if ($type == 'quiz') {
$sql = 'SELECT SUM(ponderation) $sql = 'SELECT SUM(ponderation)
@ -583,7 +583,7 @@ class learnpath {
$file = $file_components[count($file_components) - 1]; $file = $file_components[count($file_components) - 1];
// Store the mp3 file in the lp_item table. // Store the mp3 file in the lp_item table.
$sql_insert_audio = "UPDATE $tbl_lp_item SET audio = '" . Database :: escape_string($file) . "' WHERE id = '" . Database :: escape_string($new_item_id) . "'"; $sql_insert_audio = "UPDATE $tbl_lp_item SET audio = '" . Database::escape_string($file) . "' WHERE id = '" . Database::escape_string($new_item_id) . "'";
Database::query($sql_insert_audio); Database::query($sql_insert_audio);
} }
return $new_item_id; return $new_item_id;
@ -1080,7 +1080,7 @@ class learnpath {
$path = handle_uploaded_document($c_det, $audio, $bp, '/audio', api_get_user_id(), 0, null, '', 0, 'rename', false, 0); $path = handle_uploaded_document($c_det, $audio, $bp, '/audio', api_get_user_id(), 0, null, '', 0, 'rename', false, 0);
$path = substr($path, 7); $path = substr($path, 7);
// Update reference in lp_item - audio path is the path from inside de document/audio/ dir. // Update reference in lp_item - audio path is the path from inside de document/audio/ dir.
$audio_update_sql = ", audio = '" . Database :: escape_string($path) . "' "; $audio_update_sql = ", audio = '" . Database::escape_string($path) . "' ";
} }
} }
@ -1091,11 +1091,11 @@ class learnpath {
if ($same_parent && $same_previous) { if ($same_parent && $same_previous) {
// Only update title and description. // Only update title and description.
$sql_update = " UPDATE " . $tbl_lp_item . " $sql_update = " UPDATE " . $tbl_lp_item . "
SET title = '" . $this->escape_string($title) . "', SET title = '" . Database::escape_string($title) . "',
prerequisite = '" . $prerequisites . "', prerequisite = '" . $prerequisites . "',
description = '" . $this->escape_string($description) . "' description = '" . Database::escape_string($description) . "'
" . $audio_update_sql . ", " . $audio_update_sql . ",
max_time_allowed = '" . $this->escape_string($max_time_allowed) . "' max_time_allowed = '" . Database::escape_string($max_time_allowed) . "'
WHERE c_id = ".$course_id." AND id = " . $id; WHERE c_id = ".$course_id." AND id = " . $id;
$res_update = Database::query($sql_update); $res_update = Database::query($sql_update);
} else { } else {
@ -1193,8 +1193,8 @@ class learnpath {
// Update the current item with the new data. // Update the current item with the new data.
$sql_update = "UPDATE " . $tbl_lp_item . " $sql_update = "UPDATE " . $tbl_lp_item . "
SET SET
title = '" . $this->escape_string($title) . "', title = '" . Database::escape_string($title) . "',
description = '" . $this->escape_string($description) . "', description = '" . Database::escape_string($description) . "',
parent_item_id = " . $parent . ", parent_item_id = " . $parent . ",
previous_item_id = " . $previous . ", previous_item_id = " . $previous . ",
next_item_id = " . $new_next . ", next_item_id = " . $new_next . ",
@ -1274,7 +1274,7 @@ class learnpath {
return false; return false;
} }
$prerequisite_id = $this->escape_string($prerequisite_id); $prerequisite_id = Database::escape_string($prerequisite_id);
$tbl_lp_item = Database :: get_course_table(TABLE_LP_ITEM); $tbl_lp_item = Database :: get_course_table(TABLE_LP_ITEM);
@ -1312,7 +1312,7 @@ class learnpath {
*/ */
public function escape_string($string) { public function escape_string($string) {
//if ($this->debug > 0) { error_log('New LP - In learnpath::escape_string('.$string.')', 0); } //if ($this->debug > 0) { error_log('New LP - In learnpath::escape_string('.$string.')', 0); }
return Database :: escape_string($string); return Database::escape_string($string);
} }
/** /**
@ -1604,7 +1604,7 @@ class learnpath {
} }
$info = ''; $info = '';
$item_id = $this->escape_string($item_id); $item_id = Database::escape_string($item_id);
if (!empty($item_id) && is_object($this->items[$item_id])) { if (!empty($item_id) && is_object($this->items[$item_id])) {
//if item is defined, return values from DB //if item is defined, return values from DB
@ -2992,8 +2992,8 @@ class learnpath {
} }
if ($type_quiz) { if ($type_quiz) {
$lp_item_id = Database :: escape_string($lp_item_id); $lp_item_id = Database::escape_string($lp_item_id);
$lp_view_id = Database :: escape_string($lp_view_id); $lp_view_id = Database::escape_string($lp_view_id);
$sql = "SELECT count(*) FROM $lp_item_view_table $sql = "SELECT count(*) FROM $lp_item_view_table
WHERE c_id = $course_id AND lp_item_id='" . (int) $lp_item_id . "' AND lp_view_id ='" . (int) $lp_view_id . "' AND status='completed'"; WHERE c_id = $course_id AND lp_item_id='" . (int) $lp_item_id . "' AND lp_view_id ='" . (int) $lp_view_id . "' AND status='completed'";
$result = Database::query($sql); $result = Database::query($sql);
@ -3739,7 +3739,7 @@ class learnpath {
// TODO: Do a better check on the index pointing to the right item (it is supposed to be working // TODO: Do a better check on the index pointing to the right item (it is supposed to be working
// on $ordered_items[] but not sure it's always safe to use with $items[]). // on $ordered_items[] but not sure it's always safe to use with $items[]).
if (empty ($item_id)) { if (empty ($item_id)) {
$item_id = $this->escape_string($_REQUEST['id']); $item_id = Database::escape_string($_REQUEST['id']);
} }
if (empty ($item_id)) { if (empty ($item_id)) {
$item_id = $this->get_current_item_id(); $item_id = $this->get_current_item_id();
@ -3812,7 +3812,7 @@ class learnpath {
error_log('New LP - New current item given is ' . $item_id . '...', 0); error_log('New LP - New current item given is ' . $item_id . '...', 0);
} }
if (is_numeric($item_id)) { if (is_numeric($item_id)) {
$item_id = $this->escape_string($item_id); $item_id = Database::escape_string($item_id);
// TODO: Check in database here. // TODO: Check in database here.
$this->last = $this->current; $this->last = $this->current;
$this->current = $item_id; $this->current = $item_id;
@ -3921,7 +3921,7 @@ class learnpath {
} }
if (empty ($name)) if (empty ($name))
return false; return false;
$this->maker = $this->escape_string($name); $this->maker = Database::escape_string($name);
$lp_table = Database :: get_course_table(TABLE_LP_MAIN); $lp_table = Database :: get_course_table(TABLE_LP_MAIN);
$course_id = api_get_course_int_id(); $course_id = api_get_course_int_id();
$lp_id = $this->get_id(); $lp_id = $this->get_id();
@ -3945,7 +3945,7 @@ class learnpath {
if (empty ($name)) if (empty ($name))
return false; return false;
$this->name = $this->escape_string($name); $this->name = Database::escape_string($name);
$lp_table = Database :: get_course_table(TABLE_LP_MAIN); $lp_table = Database :: get_course_table(TABLE_LP_MAIN);
$lp_id = $this->get_id(); $lp_id = $this->get_id();
$course_id = api_get_course_int_id(); $course_id = api_get_course_int_id();
@ -4055,7 +4055,7 @@ class learnpath {
if ($this->debug > 0) { if ($this->debug > 0) {
error_log('New LP - In learnpath::set_theme()', 0); error_log('New LP - In learnpath::set_theme()', 0);
} }
$this->theme = $this->escape_string($name); $this->theme = Database::escape_string($name);
$lp_table = Database :: get_course_table(TABLE_LP_MAIN); $lp_table = Database :: get_course_table(TABLE_LP_MAIN);
$lp_id = $this->get_id(); $lp_id = $this->get_id();
$sql = "UPDATE $lp_table SET theme = '" . $this->theme . "' WHERE c_id = ".$course_id." AND id = '$lp_id'"; $sql = "UPDATE $lp_table SET theme = '" . $this->theme . "' WHERE c_id = ".$course_id." AND id = '$lp_id'";
@ -4078,7 +4078,7 @@ class learnpath {
error_log('New LP - In learnpath::set_preview_image()', 0); error_log('New LP - In learnpath::set_preview_image()', 0);
} }
$this->preview_image = $this->escape_string($name); $this->preview_image = Database::escape_string($name);
$lp_table = Database :: get_course_table(TABLE_LP_MAIN); $lp_table = Database :: get_course_table(TABLE_LP_MAIN);
$lp_id = $this->get_id(); $lp_id = $this->get_id();
$sql = "UPDATE $lp_table SET preview_image = '" . $this->preview_image . "' WHERE c_id = ".$course_id." AND id = '$lp_id'"; $sql = "UPDATE $lp_table SET preview_image = '" . $this->preview_image . "' WHERE c_id = ".$course_id." AND id = '$lp_id'";
@ -4099,7 +4099,7 @@ class learnpath {
if ($this->debug > 0) { if ($this->debug > 0) {
error_log('New LP - In learnpath::set_author()', 0); error_log('New LP - In learnpath::set_author()', 0);
} }
$this->author = $this->escape_string($name); $this->author = Database::escape_string($name);
$lp_table = Database :: get_course_table(TABLE_LP_MAIN); $lp_table = Database :: get_course_table(TABLE_LP_MAIN);
$lp_id = $this->get_id(); $lp_id = $this->get_id();
$sql = "UPDATE $lp_table SET author = '" . $this->author . "' WHERE c_id = ".$course_id." AND id = '$lp_id'"; $sql = "UPDATE $lp_table SET author = '" . $this->author . "' WHERE c_id = ".$course_id." AND id = '$lp_id'";
@ -4170,7 +4170,7 @@ class learnpath {
if (empty ($name)) if (empty ($name))
return false; return false;
$this->proximity = $this->escape_string($name); $this->proximity = Database::escape_string($name);
$lp_table = Database :: get_course_table(TABLE_LP_MAIN); $lp_table = Database :: get_course_table(TABLE_LP_MAIN);
$lp_id = $this->get_id(); $lp_id = $this->get_id();
$sql = "UPDATE $lp_table SET content_local = '" . $this->proximity . "' $sql = "UPDATE $lp_table SET content_local = '" . $this->proximity . "'
@ -4229,7 +4229,7 @@ class learnpath {
} }
if (!empty($expired_on)) { if (!empty($expired_on)) {
$this->expired_on = $this->escape_string(api_get_utc_datetime($expired_on)); $this->expired_on = Database::escape_string(api_get_utc_datetime($expired_on));
} else { } else {
$this->expired_on = ''; $this->expired_on = '';
} }
@ -4243,7 +4243,6 @@ class learnpath {
return true; return true;
} }
/** /**
* Sets and saves the publicated_on date * Sets and saves the publicated_on date
* @param string Optional string giving the new author of this learnpath * @param string Optional string giving the new author of this learnpath
@ -4255,7 +4254,7 @@ class learnpath {
error_log('New LP - In learnpath::set_expired_on()', 0); error_log('New LP - In learnpath::set_expired_on()', 0);
} }
if (!empty($publicated_on)) { if (!empty($publicated_on)) {
$this->publicated_on = $this->escape_string(api_get_utc_datetime($publicated_on)); $this->publicated_on = Database::escape_string(api_get_utc_datetime($publicated_on));
} else { } else {
$this->publicated_on = ''; $this->publicated_on = '';
} }
@ -5248,7 +5247,7 @@ class learnpath {
$sql = " SELECT id, title, description, item_type, path, parent_item_id, previous_item_id, next_item_id, max_score, min_score, mastery_score, display_order $sql = " SELECT id, title, description, item_type, path, parent_item_id, previous_item_id, next_item_id, max_score, min_score, mastery_score, display_order
FROM $tbl_lp_item FROM $tbl_lp_item
WHERE c_id = ".$course_id." AND lp_id = " . Database :: escape_string($this->lp_id); WHERE c_id = ".$course_id." AND lp_id = " . Database::escape_string($this->lp_id);
$result = Database::query($sql); $result = Database::query($sql);
$arrLP = array (); $arrLP = array ();
@ -5421,7 +5420,7 @@ class learnpath {
if ($new_comment) if ($new_comment)
$ct .= ", comment='" . Database::escape_string($new_comment). "'"; $ct .= ", comment='" . Database::escape_string($new_comment). "'";
if ($new_title) if ($new_title)
$ct .= ", title='" . Database :: escape_string(htmlspecialchars($new_title, ENT_QUOTES, $charset))."' "; $ct .= ", title='" . Database::escape_string(htmlspecialchars($new_title, ENT_QUOTES, $charset))."' ";
$sql_update = "UPDATE " . $tbl_doc ." SET " . substr($ct, 1)." WHERE c_id = ".$course_id." AND id = " . $document_id; $sql_update = "UPDATE " . $tbl_doc ." SET " . substr($ct, 1)." WHERE c_id = ".$course_id." AND id = " . $document_id;
Database::query($sql_update); Database::query($sql_update);
@ -5502,7 +5501,7 @@ class learnpath {
$tbl_lp_item = Database :: get_course_table(TABLE_LP_ITEM); $tbl_lp_item = Database :: get_course_table(TABLE_LP_ITEM);
$tbl_doc = Database :: get_course_table(TABLE_DOCUMENT); $tbl_doc = Database :: get_course_table(TABLE_DOCUMENT);
$sql = "SELECT lp.* FROM " . $tbl_lp_item . " as lp $sql = "SELECT lp.* FROM " . $tbl_lp_item . " as lp
WHERE c_id = ".$course_id." AND lp.id = " . Database :: escape_string($item_id); WHERE c_id = ".$course_id." AND lp.id = " . Database::escape_string($item_id);
$result = Database::query($sql); $result = Database::query($sql);
while ($row = Database :: fetch_array($result,'ASSOC')) { while ($row = Database :: fetch_array($result,'ASSOC')) {
$_SESSION['parent_item_id'] = ($row['item_type'] == 'dokeos_chapter' || $row['item_type'] == 'dokeos_module' || $row['item_type'] == 'dir') ? $item_id : 0; $_SESSION['parent_item_id'] = ($row['item_type'] == 'dokeos_chapter' || $row['item_type'] == 'dokeos_module' || $row['item_type'] == 'dir') ? $item_id : 0;
@ -5530,7 +5529,7 @@ class learnpath {
break; break;
case TOOL_DOCUMENT: case TOOL_DOCUMENT:
$tbl_doc = Database :: get_course_table(TABLE_DOCUMENT); $tbl_doc = Database :: get_course_table(TABLE_DOCUMENT);
$sql_doc = "SELECT path FROM " . $tbl_doc . " WHERE c_id = ".$course_id." AND id = " . Database :: escape_string($row['path']); $sql_doc = "SELECT path FROM " . $tbl_doc . " WHERE c_id = ".$course_id." AND id = " . Database::escape_string($row['path']);
$result = Database::query($sql_doc); $result = Database::query($sql_doc);
$path_file = Database::result($result, 0, 0); $path_file = Database::result($result, 0, 0);
$path_parts = pathinfo($path_file); $path_parts = pathinfo($path_file);
@ -5568,7 +5567,7 @@ class learnpath {
$return = ''; $return = '';
if (is_numeric($item_id)) { if (is_numeric($item_id)) {
$tbl_lp_item = Database :: get_course_table(TABLE_LP_ITEM); $tbl_lp_item = Database :: get_course_table(TABLE_LP_ITEM);
$sql = "SELECT * FROM $tbl_lp_item WHERE c_id = ".$course_id." AND id = " . Database :: escape_string($item_id); $sql = "SELECT * FROM $tbl_lp_item WHERE c_id = ".$course_id." AND id = " . Database::escape_string($item_id);
$res = Database::query($sql); $res = Database::query($sql);
$row = Database::fetch_array($res); $row = Database::fetch_array($res);
@ -5591,7 +5590,7 @@ class learnpath {
LEFT JOIN " . $tbl_doc . " as doc ON doc.id = lp.path LEFT JOIN " . $tbl_doc . " as doc ON doc.id = lp.path
WHERE lp.c_id = $course_id AND WHERE lp.c_id = $course_id AND
doc.c_id = $course_id AND doc.c_id = $course_id AND
lp.id = " . Database :: escape_string($item_id); lp.id = " . Database::escape_string($item_id);
$res_step = Database::query($sql_step); $res_step = Database::query($sql_step);
$row_step = Database :: fetch_array($res_step); $row_step = Database :: fetch_array($res_step);
$return .= $this->display_manipulate($item_id, $row['item_type']); $return .= $this->display_manipulate($item_id, $row['item_type']);
@ -5601,7 +5600,7 @@ class learnpath {
$link_id = (string) $row['path']; $link_id = (string) $row['path'];
if (ctype_digit($link_id)) { if (ctype_digit($link_id)) {
$tbl_link = Database :: get_course_table(TABLE_LINK); $tbl_link = Database :: get_course_table(TABLE_LINK);
$sql_select = 'SELECT url FROM ' . $tbl_link . ' WHERE c_id = '.$course_id.' AND id = ' . Database :: escape_string($link_id); $sql_select = 'SELECT url FROM ' . $tbl_link . ' WHERE c_id = '.$course_id.' AND id = ' . Database::escape_string($link_id);
$res_link = Database::query($sql_select); $res_link = Database::query($sql_select);
$row_link = Database :: fetch_array($res_link); $row_link = Database :: fetch_array($res_link);
if (is_array($row_link)) { if (is_array($row_link)) {
@ -6773,7 +6772,7 @@ class learnpath {
// We don't display the document form if it's not an editable document (html or txt file). // We don't display the document form if it's not an editable document (html or txt file).
if ($action == "add") { if ($action == "add") {
if (is_numeric($extra_info)) { if (is_numeric($extra_info)) {
$sql_doc = "SELECT path FROM " . $tbl_doc . " WHERE c_id = ".$course_id." AND id = " . Database :: escape_string($extra_info); $sql_doc = "SELECT path FROM " . $tbl_doc . " WHERE c_id = ".$course_id." AND id = " . Database::escape_string($extra_info);
$result = Database::query($sql_doc); $result = Database::query($sql_doc);
$path_file = Database :: result($result, 0, 0); $path_file = Database :: result($result, 0, 0);
$path_parts = pathinfo($path_file); $path_parts = pathinfo($path_file);
@ -6792,7 +6791,7 @@ class learnpath {
} }
} elseif (is_numeric($extra_info)) { } elseif (is_numeric($extra_info)) {
$sql_doc = "SELECT path, title FROM " . $tbl_doc . " $sql_doc = "SELECT path, title FROM " . $tbl_doc . "
WHERE c_id = ".$course_id." AND id = " . Database :: escape_string($extra_info); WHERE c_id = ".$course_id." AND id = " . Database::escape_string($extra_info);
$result = Database::query($sql_doc); $result = Database::query($sql_doc);
$row = Database::fetch_array($result); $row = Database::fetch_array($result);

Write Preview
Loading…
Cancel
Save