Autres/Rivendellaudio
1
0
Fork 0
mirror of https://github.com/ElvishArtisan/rivendell.git synced 2025-08-08 08:01:27 +02:00
Code Issues Projects Releases Wiki Activity

2021-12-03 Fred Gleason <fredg@paravelsystems.com>

Browse Source 
* Fixed a SQL escaping bug in 'lib/export_resultsrecon.cpp'.
	* Fixed a SQL escaping bug in 'lib/rdlibrarymodel.cpp'.
	* Fixed a SQL escaping bug in 'rdlibrary/rdlibrary.cpp'.

Signed-off-by: Fred Gleason <fredg@paravelsystems.com>
This commit is contained in:
Fred Gleason 2021-12-03 16:21:57 -05:00
parent b7059f300c
commit 3aaa1d5206
4 changed files with 7 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
ChangeLog
View File

@ -22593,3 +22593,7 @@
2021-12-03 Fred Gleason <fredg@paravelsystems.com>
* Fixed a regression in 'RDCart::xml()' that caused a SQL error
to be generated.
2021-12-03 Fred Gleason <fredg@paravelsystems.com>
* Fixed a SQL escaping bug in 'lib/export_resultsrecon.cpp'.
* Fixed a SQL escaping bug in 'lib/rdlibrarymodel.cpp'.
* Fixed a SQL escaping bug in 'rdlibrary/rdlibrary.cpp'.

2
lib/export_resultsrecon.cpp
View File

@ -54,7 +54,7 @@ bool RDReport::ExportResultsReport(const QString &filename,
"`ELR_LINES`.`ARTIST`,"+ // 06
"`ELR_LINES`.`EXT_START_TIME` "+ // 07
"from `ELR_LINES` left join `CART` "+
"on `ELR_LINES`.`CART_NUMBER`=`CART.NUMBER` where "+
"on `ELR_LINES`.`CART_NUMBER`=`CART`.`NUMBER` where "+
"`SERVICE_NAME`='"+RDEscapeString(mixtable)+"' "+
"order by `EVENT_DATETIME`";
q=new RDSqlQuery(sql);

2
lib/rdlibrarymodel.cpp
View File

@ -437,7 +437,7 @@ QModelIndex RDLibraryModel::addCart(unsigned cartnum)
QString sql=sqlFields()+
"where "+
QString::asprintf("CART.NUMBER=%u",cartnum);
QString::asprintf("`CART`.`NUMBER`=%u",cartnum);
RDSqlQuery *q=new RDSqlQuery(sql);
if(q->first()) {
updateRow(offset,q);

2
rdlibrary/rdlibrary.cpp
View File

@ -691,7 +691,7 @@ void MainWidget::notificationReceivedData(RDNotification *notify)
unsigned cartnum=notify->id().toUInt();
switch(notify->action()) {
case RDNotification::AddAction:
and_fields.push_back(QString::asprintf("CART.NUMBER=%u",cartnum));
and_fields.push_back(QString::asprintf("`CART`.`NUMBER`=%u",cartnum));
sql=QString("select ")+
"`CART`.`NUMBER` "+ // 00
"from `CART` "+