Design/EasySoft-ZenTaoPMS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 30 Wiki Activity

* Check fields in groupBy function and limit function for safety.

Browse Source
This commit is contained in:
liugang
2018-04-16 15:46:45 +08:00
parent 0f90a0cf2f
commit 4d0e6ba52e
1 changed files with 19 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/base/dao/dao.class.php
+19 -11
View File
@@ -346,7 +346,7 @@ class baseDAO
* The count method, call sql::select() and from().
* use as $this->dao->select()->from(TABLE_BUG)->where()->count();
*
* @param string $distinctField
* @param string $distinctField
* @access public
* @return void
*/
@@ -357,7 +357,7 @@ class baseDAO
$sql = $this->get();
$selectPOS = strpos($sql, 'SELECT') + strlen('SELECT');
$fromPOS = strpos($sql, 'FROM');
$fields = substr($sql, $selectPOS, $fromPOS - $selectPOS );
$fields = substr($sql, $selectPOS, $fromPOS - $selectPOS);
$countField = $distinctField ? 'distinct ' . $distinctField : '*';
$sql = str_replace($fields, " COUNT($countField) AS recTotal ", substr($sql, 0, $fromPOS)) . substr($sql, $fromPOS);
@@ -373,7 +373,7 @@ class baseDAO
$sql = substr($sql, 0, $subLength);
self::$querys[] = $sql;
/*
/*
* 获取记录数。
* Get the records count.
**/
@@ -381,7 +381,7 @@ class baseDAO
{
$row = $this->dbh->query($sql)->fetch(PDO::FETCH_OBJ);
}
catch (PDOException $e)
catch (PDOException $e)
{
$this->sqlError($e);
}
@@ -393,7 +393,7 @@ class baseDAO
* update方法，调用sql::update()。
* The update method, call sql::update().
*
* @param string $table
* @param string $table
* @access public
* @return object the dao object self.
*/
@@ -876,7 +876,7 @@ class baseDAO
$rows = array();
while($row = $stmt->fetch())
{
empty($keyField) ? $rows[$row->$groupField][] = $row : $rows[$row->$groupField][$row->$keyField] = $this->getRow($row);
empty($keyField) ? $rows[$row->$groupField][] = $row : $rows[$row->$groupField][$row->$keyField] = $this->getRow($row);
}
dao::$cache[$table][$key] = $rows;
return $rows;
@@ -941,9 +941,9 @@ class baseDAO
/**
* 重新生成数据。
* Get row by data.
*
* @param array/object $data
* Get row by data.
*
* @param array/object $data
* @access public
* @return array/object
*/
@@ -2003,7 +2003,6 @@ class baseSQL
if(!preg_match('/^[0-9]+ *(, *[0-9]+)?$/', $trimedLimit)) die("Limit is bad query, The limit is " . htmlspecialchars($limit));
}
$orders = trim($orders);
if(empty($orders)) return $this;
if(!preg_match('/^(\w+\.)?(`\w+`|\w+)( +(desc|asc))?( *(, *(\w+\.)?(`\w+`|\w+)( +(desc|asc))?)?)*$/i', $orders)) die("Order is bad request, The order is " . htmlspecialchars($orders));
@@ -2049,7 +2048,11 @@ class baseSQL
/* filter limit. */
$limit = trim(str_ireplace('limit', '', $limit));
if(!preg_match('/^[0-9]+ *(, *[0-9]+)?$/', $limit)) die("Limit is bad query, The limit is $limit");
if(!preg_match('/^[0-9]+ *(, *[0-9]+)?$/', $limit))
{
$limit = htmlspecialchars($limit);
die("Limit is bad query, The limit is $limit");
}
$this->sql .= ' ' . DAO::LIMIT . " $limit ";
return $this;
}
@@ -2065,6 +2068,11 @@ class baseSQL
public function groupBy($groupBy)
{
if($this->inCondition and !$this->conditionIsTrue) return $this;
if(!preg_match('/^\w+[a-zA-Z0-9_`.]+$/', $groupBy))
{
$groupBy = htmlspecialchars($groupBy);
die("Group is bad query, The group is $groupBy");
}
$this->sql .= ' ' . DAO::GROUPBY . " $groupBy";
return $this;
}