Design/EasySoft-ZenTaoPMS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 30 Wiki Activity

* Fix for sql injection attack.

Browse Source
This commit is contained in:
Yagami
2020-02-24 14:09:11 +08:00
parent 310c31b8ec
commit 7b2949916b
5 changed files with 11 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
module/task/model.php
+3 -2
View File
@@ -27,11 +27,12 @@ class taskModel extends model
dao::$errors[] = $this->lang->task->error->recordMinus;
return false;
}
$projectID = (int)$projectID;
$taskIdList = array();
$taskFiles = array();
$this->loadModel('file');
$task = fixer::input('post')
->setDefault('project', (int)$projectID)
->setDefault('project', $projectID)
->setDefault('estimate,left,story', 0)
->setDefault('status', 'wait')
->setIF($this->post->estimate != false, 'left', $this->post->estimate)
@@ -65,7 +66,7 @@ class taskModel extends model
/* Check duplicate task. */
if($task->type != 'affair')
{
$result = $this->loadModel('common')->removeDuplicate('task', $task, "project=$projectID and story=" . (int)$task->story);
$result = $this->loadModel('common')->removeDuplicate('task', $task, "project={$projectID} and story=" . (int)$task->story);
if($result['stop'])
{
$taskIdList[$assignedTo] = array('status' => 'exists', 'id' => $result['duplicate']);