Autres/Rivendellaudio
1
0
Fork 0
mirror of https://github.com/ElvishArtisan/rivendell.git synced 2025-10-17 16:11:12 +02:00
Code Issues Projects Releases Wiki Activity

2021-04-23 Fred Gleason <fredg@paravelsystems.com>

Browse Source 
* Escaped all SQL identifiers in 'web/rdxport/'.
	* Replaced " with ' delimiters in all SQL literal strings in
	'web/rdxport/'.

Signed-off-by: Fred Gleason <fredg@paravelsystems.com>
This commit is contained in:
Fred Gleason
2021-04-23 13:55:42 -04:00
parent ac82d7356a
commit 703299899c
8 changed files with 54 additions and 48 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
web/rdxport/carts.cpp
View File

@@ -151,9 +151,9 @@ void Xport::ListCarts()
where=RDAllCartSearchText(filter,"",rda->user()->name(),false);
}
else {
sql=QString("select GROUP_NAME from USER_PERMS where ")+
"(GROUP_NAME=\""+RDEscapeString(group_name)+"\")&&"+
"(USER_NAME=\""+RDEscapeString(rda->user()->name())+"\")";
sql=QString("select `GROUP_NAME` from `USER_PERMS` where ")+
"(`GROUP_NAME`='"+RDEscapeString(group_name)+"')&&"+
"(`USER_NAME`='"+RDEscapeString(rda->user()->name())+"')";
q=new RDSqlQuery(sql);
if(!q->first()) {
delete q;
@@ -162,9 +162,9 @@ void Xport::ListCarts()
where=RDCartSearchText(filter,group_name,"",false);
}
if(cart_type!=RDCart::All) {
where+=QString().sprintf("&&(TYPE=%u)",cart_type);
where+=QString().sprintf("&&(`TYPE`=%u)",cart_type);
}
sql=RDCart::xmlSql(include_cuts)+where+" order by CART.NUMBER";
sql=RDCart::xmlSql(include_cuts)+where+" order by `CART`.`NUMBER`";
q=new RDSqlQuery(sql);
//
@@ -529,7 +529,7 @@ void Xport::ListCuts()
// Process Request
//
sql=RDCart::xmlSql(true)+
QString().sprintf(" where CART.NUMBER=%u",cart_number);
QString().sprintf(" where `CART`.`NUMBER`=%u",cart_number);
q=new RDSqlQuery(sql);
printf("Content-type: application/xml\n");
printf("Status: 200\n\n");