From 43ac49410668f893380db85fd835ea6d87aa5039 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E7=8E=8B=E6=80=A1=E6=A0=8B?= <wangyidong@cnezsoft.com>
Date: Mon, 25 Oct 2021 08:42:13 +0800
Subject: [PATCH]  * fix bug for loophole.

---
 module/action/model.php     |  2 +-
 module/product/model.php    | 13 +++++++------
 module/testcase/control.php |  2 +-
 3 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/module/action/model.php b/module/action/model.php
index 61cf3e0d9b..3584f68631 100755
--- a/module/action/model.php
+++ b/module/action/model.php
@@ -69,7 +69,7 @@ class actionModel extends model
 
 
         $this->dao->insert(TABLE_ACTION)->data($action)->autoCheck()->exec();
-        $actionID = $this->dbh->lastInsertID();
+        $actionID = $this->dao->lastInsertID();
 
         if($this->post->uid) $this->file->updateObjectID($this->post->uid, $objectID, $objectType);
 
diff --git a/module/product/model.php b/module/product/model.php
index d8be0d310d..e5ca8375eb 100644
--- a/module/product/model.php
+++ b/module/product/model.php
@@ -145,14 +145,15 @@ class productModel extends model
      */
     public function saveState($productID, $products)
     {
-        if($productID > 0) $this->session->set('product', (int)$productID);
-        if($productID == 0 and $this->cookie->lastProduct)    $this->session->set('product', (int)$this->cookie->lastProduct);
-        if($productID == 0 and $this->session->product == '') $this->session->set('product', key($products));
+        if($productID == 0 and $this->cookie->lastProduct)    $productID = $this->cookie->lastProduct;
+        if($productID == 0 and $this->session->product == '') $productID = key($products);
+        $this->session->set('product', (int)$productID, $this->app->tab);
+
         if(!isset($products[$this->session->product]))
         {
-            $product = $this->getById($productID);
-            if(empty($product)) $this->session->set('product', key($products));
-            if($productID && strpos(",{$this->app->user->view->products},", ",{$this->session->product},") === false) $this->accessDenied();
+            $productID = key($products);
+            $this->session->set('product', (int)$productID, $this->app->tab);
+            if($productID && strpos(",{$this->app->user->view->products},", ",{$productID},") === false) $this->accessDenied();
         }
         if($this->cookie->preProductID != $productID)
         {
diff --git a/module/testcase/control.php b/module/testcase/control.php
index aed4fff98d..b9ae238cda 100644
--- a/module/testcase/control.php
+++ b/module/testcase/control.php
@@ -1307,7 +1307,7 @@ class testcase extends control
             {
                 $cases   = array();
                 $orderBy = " ORDER BY " . str_replace(array('|', '^A', '_'), ' ', $orderBy);
-                $stmt    = $this->dbh->query($this->session->testcaseQueryCondition . $orderBy . ($this->post->limit ? ' LIMIT ' . $this->post->limit : ''));
+                $stmt    = $this->dao->query($this->session->testcaseQueryCondition . $orderBy . ($this->post->limit ? ' LIMIT ' . $this->post->limit : ''));
                 while($row = $stmt->fetch())
                 {
                     $caseID = isset($row->case) ? $row->case : $row->id;