From 4d0e6ba52e9f6fbe4a9731fa220a2bc258b3b567 Mon Sep 17 00:00:00 2001
From: liugang <liugang@cnezsoft.com>
Date: Mon, 16 Apr 2018 15:46:45 +0800
Subject: [PATCH] * Check fields in groupBy function and limit function for
 safety.

---
 lib/base/dao/dao.class.php | 30 +++++++++++++++++++-----------
 1 file changed, 19 insertions(+), 11 deletions(-)

diff --git a/lib/base/dao/dao.class.php b/lib/base/dao/dao.class.php
index cffee28715..5389fd0869 100644
--- a/lib/base/dao/dao.class.php
+++ b/lib/base/dao/dao.class.php
@@ -346,7 +346,7 @@ class baseDAO
      * The count method, call sql::select() and from().
      * use as $this->dao->select()->from(TABLE_BUG)->where()->count();
      *
-     * @param  string $distinctField 
+     * @param  string $distinctField
      * @access public
      * @return void
      */
@@ -357,7 +357,7 @@ class baseDAO
         $sql        = $this->get();
         $selectPOS  = strpos($sql, 'SELECT') + strlen('SELECT');
         $fromPOS    = strpos($sql, 'FROM');
-        $fields     = substr($sql, $selectPOS, $fromPOS - $selectPOS );
+        $fields     = substr($sql, $selectPOS, $fromPOS - $selectPOS);
         $countField = $distinctField ? 'distinct ' . $distinctField : '*';
         $sql        = str_replace($fields, " COUNT($countField) AS recTotal ", substr($sql, 0, $fromPOS)) . substr($sql, $fromPOS);
 
@@ -373,7 +373,7 @@ class baseDAO
         $sql = substr($sql, 0, $subLength);
         self::$querys[] = $sql;
 
-        /* 
+        /*
          * 获取记录数。
          * Get the records count.
          **/
@@ -381,7 +381,7 @@ class baseDAO
         {
             $row = $this->dbh->query($sql)->fetch(PDO::FETCH_OBJ);
         }
-        catch (PDOException $e) 
+        catch (PDOException $e)
         {
             $this->sqlError($e);
         }
@@ -393,7 +393,7 @@ class baseDAO
      * update方法，调用sql::update()。
      * The update method, call sql::update().
      * 
-     * @param  string $table 
+     * @param  string $table
      * @access public
      * @return object the dao object self.
      */
@@ -876,7 +876,7 @@ class baseDAO
         $rows = array();
         while($row = $stmt->fetch())
         {
-            empty($keyField) ?  $rows[$row->$groupField][] = $row : $rows[$row->$groupField][$row->$keyField] = $this->getRow($row);
+            empty($keyField) ? $rows[$row->$groupField][] = $row : $rows[$row->$groupField][$row->$keyField] = $this->getRow($row);
         }
         dao::$cache[$table][$key] = $rows;
         return $rows;
@@ -941,9 +941,9 @@ class baseDAO
 
     /**
      * 重新生成数据。
-     * Get row by data. 
-     * 
-     * @param  array/object    $data 
+     * Get row by data.
+     *
+     * @param  array/object    $data
      * @access public
      * @return array/object
      */
@@ -2003,7 +2003,6 @@ class baseSQL
             if(!preg_match('/^[0-9]+ *(, *[0-9]+)?$/', $trimedLimit)) die("Limit is bad query, The limit is " . htmlspecialchars($limit));
         }
 
-
         $orders = trim($orders);
         if(empty($orders)) return $this;
         if(!preg_match('/^(\w+\.)?(`\w+`|\w+)( +(desc|asc))?( *(, *(\w+\.)?(`\w+`|\w+)( +(desc|asc))?)?)*$/i', $orders)) die("Order is bad request, The order is " . htmlspecialchars($orders));
@@ -2049,7 +2048,11 @@ class baseSQL
 
         /* filter limit. */
         $limit = trim(str_ireplace('limit', '', $limit));
-        if(!preg_match('/^[0-9]+ *(, *[0-9]+)?$/', $limit)) die("Limit is bad query, The limit is $limit");
+        if(!preg_match('/^[0-9]+ *(, *[0-9]+)?$/', $limit))
+        {
+            $limit = htmlspecialchars($limit);
+            die("Limit is bad query, The limit is $limit");
+        }
         $this->sql .= ' ' . DAO::LIMIT . " $limit ";
         return $this;
     }
@@ -2065,6 +2068,11 @@ class baseSQL
     public function groupBy($groupBy)
     {
         if($this->inCondition and !$this->conditionIsTrue) return $this;
+        if(!preg_match('/^\w+[a-zA-Z0-9_`.]+$/', $groupBy))
+        {
+            $groupBy = htmlspecialchars($groupBy);
+            die("Group is bad query, The group is $groupBy");
+        }
         $this->sql .= ' ' . DAO::GROUPBY . " $groupBy";
         return $this;
     }