chamilo
/
chamilo-lms
mirror of https://github.com/chamilo/chamilo-lms/tree/1.11.x
2
0
Fork 0
Code Issues Projects Releases Wiki Activity

Add int casting, Database::escape_string in queries

Browse Source
pull/3173/head
Julio Montoya 7 years ago
parent 85700ed77c
commit ce853aac97
1 changed files with 56 additions and 46 deletions
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Show Stats Download Patch File Download Diff File
  1. 102
      main/inc/lib/usermanager.lib.php

102
main/inc/lib/usermanager.lib.php
Unescape View File

@ -697,12 +697,12 @@ class UserManager
}
$table_course_user = Database::get_main_table(TABLE_MAIN_COURSE_USER);
if ($user_id != strval(intval($user_id))) {
return false;
}
if ($user_id === false) {
$user_id = (int) $user_id;
if (empty($user_id)) {
return false;
}
$sql = "SELECT * FROM $table_course_user
WHERE status = 1 AND user_id = ".$user_id;
$res = Database::query($sql);
@ -1149,10 +1149,7 @@ class UserManager
$hook->notifyUpdateUser(HOOK_EVENT_TYPE_PRE);
}
$original_password = $password;
if ($user_id != strval(intval($user_id))) {
return false;
}
$user_id = (int) $user_id;
if (empty($user_id)) {
return false;
@ -1388,22 +1385,26 @@ class UserManager
$t_uf = Database::get_main_table(TABLE_EXTRA_FIELD);
$t_ufv = Database::get_main_table(TABLE_EXTRA_FIELD_VALUES);
$extraFieldType = EntityExtraField::USER_FIELD_TYPE;
$original_user_id_name = Database::escape_string($original_user_id_name);
$original_user_id_value = Database::escape_string($original_user_id_value);
$sql = "SELECT item_id as user_id
FROM $t_uf uf
INNER JOIN $t_ufv ufv
ON ufv.field_id=uf.id
ON ufv.field_id = uf.id
WHERE
variable='$original_user_id_name' AND
value='$original_user_id_value' AND
variable = '$original_user_id_name' AND
value = '$original_user_id_value' AND
extra_field_type = $extraFieldType
";
$res = Database::query($sql);
$row = Database::fetch_object($res);
if ($row) {
return $row->user_id;
} else {
return 0;
}
return 0;
}
/**
@ -1829,7 +1830,7 @@ class UserManager
if (empty($userInfo)) {
$user_table = Database::get_main_table(TABLE_MAIN_USER);
$sql = "SELECT email, picture_uri FROM $user_table
WHERE id=".$id;
WHERE id = ".$id;
$res = Database::query($sql);
if (!Database::num_rows($res)) {
@ -1892,7 +1893,6 @@ class UserManager
}
$id = (int) $id;
if (empty($userInfo)) {
$user_table = Database::get_main_table(TABLE_MAIN_USER);
$sql = "SELECT email, picture_uri FROM $user_table WHERE id = $id";
@ -2557,6 +2557,8 @@ class UserManager
}
$extra_data = self::get_extra_user_data_by_field($user_id, $extra_field);
$extra_files = $extra_data[$extra_field];
$files = [];
if (is_array($extra_files)) {
foreach ($extra_files as $key => $value) {
if (!$full_path) {
@ -2757,18 +2759,15 @@ class UserManager
$all_visibility = true,
$splitmultiple = false
) {
// A sanity check.
$user_id = (int) $user_id;
if (empty($user_id)) {
$user_id = 0;
} else {
if ($user_id != strval(intval($user_id))) {
return [];
}
return [];
}
$extra_data = [];
$t_uf = Database::get_main_table(TABLE_EXTRA_FIELD);
$t_ufv = Database::get_main_table(TABLE_EXTRA_FIELD_VALUES);
$user_id = (int) $user_id;
$sql = "SELECT f.id as id, f.variable as fvar, f.field_type as type
FROM $t_uf f
@ -2779,7 +2778,7 @@ class UserManager
}
$sql .= " AND extra_field_type = ".EntityExtraField::USER_FIELD_TYPE;
$sql .= " ORDER BY f.field_order";
$sql .= " ORDER BY f.field_order ";
$res = Database::query($sql);
if (Database::num_rows($res) > 0) {
@ -3283,13 +3282,14 @@ class UserManager
$tbl_course_user = Database::get_main_table(TABLE_MAIN_COURSE_USER);
$tbl_session_course_user = Database::get_main_table(TABLE_MAIN_SESSION_COURSE_USER);
if ($user_id != strval(intval($user_id))) {
$user_id = (int) $user_id;
if (empty($user_id)) {
return [];
}
// We filter the courses from the URL
$join_access_url = $where_access_url = '';
if (api_get_multiple_access_url()) {
$access_url_id = api_get_current_access_url_id();
if ($access_url_id != -1) {
@ -3502,9 +3502,8 @@ class UserManager
$user_id = (int) $user_id;
$session_id = (int) $session_id;
//we filter the courses from the URL
// We filter the courses from the URL
$join_access_url = $where_access_url = '';
if (api_get_multiple_access_url()) {
$urlId = api_get_current_access_url_id();
if ($urlId != -1) {
@ -3681,8 +3680,9 @@ class UserManager
$resourceType = 'all'
) {
$return = '';
$user_id = (int) $user_id;
if (!empty($user_id) && !empty($course)) {
$user_id = (int) $user_id;
$path = api_get_path(SYS_COURSE_PATH).$course.'/document/shared_folder/sf_user_'.$user_id.'/';
$web_path = api_get_path(WEB_COURSE_PATH).$course.'/document/shared_folder/sf_user_'.$user_id.'/';
$file_list = [];
@ -3912,7 +3912,8 @@ class UserManager
*/
public static function is_admin($user_id)
{
if (empty($user_id) || $user_id != strval(intval($user_id))) {
$user_id = (int) $user_id;
if (empty($user_id)) {
return false;
}
$admin_table = Database::get_main_table(TABLE_MAIN_ADMIN);
@ -4251,6 +4252,8 @@ class UserManager
// database table definition
$table_user_tag = Database::get_main_table(TABLE_MAIN_TAG);
$table_user_tag_values = Database::get_main_table(TABLE_MAIN_USER_REL_TAG);
$user_id = (int) $user_id;
$tags = self::get_user_tags($user_id, $field_id);
if (is_array($tags) && count($tags) > 0) {
foreach ($tags as $key => $tag) {
@ -4554,7 +4557,6 @@ class UserManager
0 => get_lang('Select'),
];
foreach ($extraField['data'] as $option) {
$checked = '';
if (isset($_GET[$varName])) {
if ($_GET[$varName] == $option[1]) {
$defaults[$option[1]] = true;
@ -4927,7 +4929,6 @@ class UserManager
$userConditions .= " AND u.last_login <= '$lastConnectionDate' ";
}
$courseConditions = null;
$sessionConditionsCoach = null;
$sessionConditionsTeacher = null;
$drhConditions = null;
@ -5139,8 +5140,8 @@ class UserManager
$userRelUserTable = Database::get_main_table(TABLE_MAIN_USER_REL_USER);
$userRelAccessUrlTable = Database::get_main_table(TABLE_MAIN_ACCESS_URL_REL_USER);
$userId = intval($userId);
$relationType = intval($relationType);
$userId = (int) $userId;
$relationType = (int) $relationType;
$affectedRows = 0;
if ($deleteOtherAssignedUsers) {
@ -5186,7 +5187,7 @@ class UserManager
// Inserting new user list
if (is_array($subscribedUsersId)) {
foreach ($subscribedUsersId as $subscribedUserId) {
$subscribedUserId = intval($subscribedUserId);
$subscribedUserId = (int) $subscribedUserId;
$sql = "SELECT id FROM $userRelUserTable
WHERE user_id = $subscribedUserId
AND friend_user_id = $userId
@ -5218,8 +5219,8 @@ class UserManager
{
// Database table and variables Definitions
$tbl_user_rel_user = Database::get_main_table(TABLE_MAIN_USER_REL_USER);
$user_id = intval($user_id);
$hr_dept_id = intval($hr_dept_id);
$user_id = (int) $user_id;
$hr_dept_id = (int) $hr_dept_id;
$result = false;
$sql = "SELECT user_id FROM $tbl_user_rel_user
@ -5248,6 +5249,11 @@ class UserManager
$table_user = Database::get_main_table(TABLE_MAIN_USER);
$table_course_user = Database::get_main_table(TABLE_MAIN_COURSE_USER);
$table_session_course_user = Database::get_main_table(TABLE_MAIN_SESSION_COURSE_USER);
if (empty($courseInfo)) {
return false;
}
$courseId = $courseInfo['real_id'];
if ($session == 0 || is_null($session)) {
@ -5376,7 +5382,7 @@ class UserManager
$table_gradebook_category = Database::get_main_table(TABLE_MAIN_GRADEBOOK_CATEGORY);
$session_id = api_get_session_id();
$user_id = intval($user_id);
$user_id = (int) $user_id;
if ($session_id == 0 || is_null($session_id)) {
$sql_session = 'AND (session_id='.intval($session_id).' OR isnull(session_id)) ';
} elseif ($session_id > 0) {
@ -5510,7 +5516,7 @@ class UserManager
public static function remove_user_admin($userId)
{
$table_admin = Database::get_main_table(TABLE_MAIN_ADMIN);
$userId = intval($userId);
$userId = (int) $userId;
if (self::is_admin($userId)) {
$sql = "DELETE FROM $table_admin WHERE user_id = $userId";
Database::query($sql);
@ -5772,8 +5778,8 @@ class UserManager
$from = '',
$until = ''
) {
$userId = intval($userId);
$sessionId = intval($sessionId);
$userId = (int) $userId;
$sessionId = (int) $sessionId;
$trackCourseAccessTable = Database::get_main_table(TABLE_STATISTIC_TRACK_E_COURSE_ACCESS);
$whereConditions = [
'user_id = ? ' => $userId,
@ -5811,7 +5817,7 @@ class UserManager
*/
public static function getFirstStudentBoss($userId)
{
$userId = intval($userId);
$userId = (int) $userId;
if ($userId > 0) {
$userRelTable = Database::get_main_table(TABLE_MAIN_USER_REL_USER);
$row = Database::select(
@ -6219,9 +6225,13 @@ SQL;
public static function anonymize($userId, $deleteIP = true)
{
global $debug;
$userId = (int) $userId;
if (empty($userId)) {
return false;
}
$em = Database::getManager();
$user = api_get_user_entity($userId);
$uniqueId = uniqid('anon', true);
@ -6701,13 +6711,13 @@ SQL;
*/
private static function change_active_state($user_id, $active)
{
if (strval(intval($user_id)) != $user_id) {
return false;
}
if ($user_id < 1) {
$user_id = (int) $user_id;
$active = (int) $active;
if (empty($user_id)) {
return false;
}
$user_id = intval($user_id);
$table_user = Database::get_main_table(TABLE_MAIN_USER);
$sql = "UPDATE $table_user SET active = '$active' WHERE id = $user_id";
$r = Database::query($sql);

Write Preview
Loading…
Cancel
Save