2021-04-20 Fred Gleason <fredg@paravelsystems.com>

* Escaped all SQL identifiers in 'utils/rdcheckcuts/'.
	* Replaced " with ' delimiters in all SQL literal strings in
	'utils/rdcheckcuts/'.

Signed-off-by: Fred Gleason <fredg@paravelsystems.com>
This commit is contained in:
Fred Gleason 2021-04-20 11:23:39 -04:00
parent 2d701bfc4c
commit 19043fea39
2 changed files with 12 additions and 5 deletions

View File

@ -21547,3 +21547,7 @@
* Escaped all SQL identifiers in 'tests/'. * Escaped all SQL identifiers in 'tests/'.
* Replaced " with ' delimiters in all SQL literal strings in * Replaced " with ' delimiters in all SQL literal strings in
'tests/'. 'tests/'.
2021-04-20 Fred Gleason <fredg@paravelsystems.com>
* Escaped all SQL identifiers in 'utils/rdcheckcuts/'.
* Replaced " with ' delimiters in all SQL literal strings in
'utils/rdcheckcuts/'.

View File

@ -2,7 +2,7 @@
// //
// Check Rivendell Cuts for Valid Audio // Check Rivendell Cuts for Valid Audio
// //
// (C) Copyright 2012-2018 Fred Gleason <fredg@paravelsystems.com> // (C) Copyright 2012-2021 Fred Gleason <fredg@paravelsystems.com>
// //
// This program is free software; you can redistribute it and/or modify // This program is free software; you can redistribute it and/or modify
// it under the terms of the GNU General Public License version 2 as // it under the terms of the GNU General Public License version 2 as
@ -67,7 +67,7 @@ MainObject::MainObject(QObject *parent)
// Build Group List // Build Group List
// //
if(group_names.size()==0) { if(group_names.size()==0) {
sql="select NAME from GROUPS order by NAME"; sql="select `NAME` from `GROUPS` order by `NAME`";
q=new RDSqlQuery(sql); q=new RDSqlQuery(sql);
while(q->next()) { while(q->next()) {
group_names.push_back(q->value(0).toString()); group_names.push_back(q->value(0).toString());
@ -117,9 +117,12 @@ bool MainObject::ValidateGroup(const QString &groupname,
RDAudioInfo *info=new RDAudioInfo(this); RDAudioInfo *info=new RDAudioInfo(this);
RDAudioInfo::ErrorCode err_code; RDAudioInfo::ErrorCode err_code;
sql=QString("select CUTS.CUT_NAME,CUTS.CART_NUMBER,CUTS.LENGTH ")+ sql=QString("select ")+
"from CUTS left join CART on CUTS.CART_NUMBER=CART.NUMBER "+ "`CUTS`.`CUT_NAME`,"+ // 00
"where CART.GROUP_NAME=\""+groupname+"\" order by CART_NUMBER"; "`CUTS`.`CART_NUMBER`,"+ // 01
"`CUTS`.`LENGTH` "+ // 02
"from `CUTS` left join `CART` on `CUTS`.`CART_NUMBER`=`CART`.`NUMBER` "+
"where `CART`.`GROUP_NAME`='"+groupname+"' order by `CUTS`.`CART_NUMBER`";
q=new RDSqlQuery(sql); q=new RDSqlQuery(sql);
while(q->next()) { while(q->next()) {
if(q->value(2).toInt()>0) { if(q->value(2).toInt()>0) {