loviuz/openstamanager
loviuz
/
openstamanager
mirror of https://github.com/devcode-it/openstamanager.git
1
0
Fork 0
Code Issues Releases Activity

Miglioramento di sicurezza 

Utilizzo della notazione "#attributo" nei metodi semplificati della classe Database per utilizzare query avanzate nei campi.
This commit is contained in:
Thomas Zilio 2017-08-28 09:58:40 +02:00
parent a98839bd70
commit 90bc71f57e
4 changed files with 17 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
lib/classes/Database.php
View File

@ -339,7 +339,7 @@ class Database extends Util\Singleton
{
$char = '`';
return $char.str_replace($char, '', $string).$char;
return $char.str_replace([$char, '#'], '', $string).$char;
}
/**
@ -372,7 +372,7 @@ class Database extends Util\Singleton
$inserts = [];
foreach ($array as $values) {
foreach ($values as $key => $value) {
$values[$key] = $this->getValue($value);
$values[$key] = $this->prepareValue($key, $value);
}
$inserts[] = '('.implode(array_values($values), ', ').')';
@ -407,12 +407,12 @@ class Database extends Util\Singleton
$update = [];
foreach ($array as $key => $value) {
$update[] = $this->quote($key).' = '.$this->getValue($value);
$update[] = $this->quote($key).' = '.$this->prepareValue($key, $value);
}
$where = [];
foreach ($conditions as $key => $value) {
$where[] = $this->quote($key).' = '.$this->getValue($value);
$where[] = $this->quote($key).' = '.$this->prepareValue($key, $value);
}
$query = 'UPDATE '.$this->quote($table).' SET '.implode($update, ', ').' WHERE '.implode($where, ' AND ');
@ -568,15 +568,15 @@ class Database extends Util\Singleton
*
* @return string
*/
protected function getValue($value)
protected function prepareValue($field, $value)
{
$value = (is_null($value)) ? 'NULL' : $value;
$value = is_bool($value) ? intval($value) : $value;
if (starts_with($value, '#') && ends_with($value, '#')) {
$value = substr($value, 1, -1);
} elseif ($value != 'NULL') {
$value = $this->prepare($value);
if (!starts_with($field, '#')) {
if ($value != 'NULL') {
$value = $this->prepare($value);
}
}
return $value;
@ -606,12 +606,12 @@ class Database extends Util\Singleton
} elseif (starts_with($value, '#') && ends_with($value, '#')) {
$result[] = substr($value, 1, -1);
} elseif (starts_with($value, '%') || ends_with($value, '%')) {
$result[] = $this->quote($key).' LIKE '.$this->getValue($value);
$result[] = $this->quote($key).' LIKE '.$this->prepareValue($key, $value);
} elseif (str_contains($value, '|')) {
$pieces = explode('|', $value);
$result[] = $this->quote($key).' BETWEEN '.$this->getValue($pieces[0]).' AND '.$this->getValue($pieces[1]);
$result[] = $this->quote($key).' BETWEEN '.$this->prepareValue($key, $pieces[0]).' AND '.$this->prepareValue($key, $pieces[1]);
} else {
$result[] = $this->quote($key).' = '.$this->getValue($value);
$result[] = $this->quote($key).' = '.$this->prepareValue($key, $value);
}
}
} else {

4
modules/articoli/modutil.php
View File

@ -85,10 +85,10 @@ function add_movimento_magazzino($idarticolo, $qta, $array = [], $descrizone = '
// Registrazione della movimentazione
$dbo->insert('mg_movimenti', array_merge($array, [
'idarticolo' => $idarticolo,
'descrizione_articolo' => '#(SELECT descrizione FROM mg_articoli WHERE id='.prepare($idarticolo).')#',
'#descrizione_articolo' => '(SELECT descrizione FROM mg_articoli WHERE id='.prepare($idarticolo).')',
'qta' => $qta,
'movimento' => $movimento,
'data' => '#NOW()#',
'#data' => 'NOW()',
]));
return true;

4
modules/fatture/actions.php
View File

@ -463,8 +463,8 @@ switch (post('op')) {
'qta' => $riga['qta'],
'sconto' => $riga['sconto'],
'sconto_unitario' => $riga['sconto_unitario'],
'order' => '#(SELECT IFNULL(MAX(`order`) + 1, 0) FROM co_righe_documenti AS t WHERE iddocumento='.prepare($id_record).')#',
'idgruppo' => '#(SELECT IFNULL(MAX(`idgruppo`) + 1, 0) FROM co_righe_documenti AS t WHERE iddocumento='.prepare($id_record).')#',
'#order' => '(SELECT IFNULL(MAX(`order`) + 1, 0) FROM co_righe_documenti AS t WHERE iddocumento='.prepare($id_record).')',
'#idgruppo' => '(SELECT IFNULL(MAX(`idgruppo`) + 1, 0) FROM co_righe_documenti AS t WHERE iddocumento='.prepare($id_record).')',
'idritenutaacconto' => get_var("Percentuale ritenuta d'acconto"),
'ritenutaacconto' => $ritenutaacconto,
'idrivalsainps' => get_var('Percentuale rivalsa INPS'),

2
modules/viste/actions.php
View File

@ -62,7 +62,7 @@ switch (filter('op')) {
$dbo->update('zz_views', $array, ['id' => $id]);
} elseif (!empty($post['query'][$c])) {
$array['order'] = '#(SELECT IFNULL(MAX(`order`) + 1, 0) FROM zz_views AS t WHERE id_module='.prepare($id_record).')#';
$array['#order'] = '(SELECT IFNULL(MAX(`order`) + 1, 0) FROM zz_views AS t WHERE id_module='.prepare($id_record).')';
$dbo->insert('zz_views', $array);