From 89f8621f7335a9966b2300c5574aa11c1a0c8563 Mon Sep 17 00:00:00 2001 From: wangyidong Date: Wed, 6 Sep 2023 09:26:58 +0800 Subject: [PATCH] * Fix safe bug. --- module/execution/model.php | 8 +++++--- module/product/model.php | 6 ++++-- module/program/model.php | 6 ++++-- module/project/model.php | 16 +++++++++------- module/repo/model.php | 16 ++++++++-------- 5 files changed, 30 insertions(+), 22 deletions(-) diff --git a/module/execution/model.php b/module/execution/model.php index 2c981a3dc0..1d2b08c645 100755 --- a/module/execution/model.php +++ b/module/execution/model.php @@ -415,6 +415,7 @@ class executionModel extends model ->setDefault('days', '0') ->setDefault('team', $this->post->name) ->setDefault('parent', $this->post->project) + ->cleanINT('project') ->setIF($this->post->parent, 'parent', $this->post->parent) ->setIF($this->post->heightType == 'auto', 'displayCards', 0) ->setIF(!isset($_POST['whitelist']), 'whitelist', '') @@ -467,7 +468,7 @@ class executionModel extends model } $this->lang->error->unique = $this->lang->error->repeat; - $sprintProject = isset($sprint->project) ? $sprint->project : '0'; + $sprintProject = isset($sprint->project) ? (int)$sprint->project : '0'; $this->dao->insert(TABLE_EXECUTION)->data($sprint) ->autoCheck($skipFields = 'begin,end') ->batchcheck($this->config->execution->create->requiredFields, 'notempty') @@ -607,6 +608,7 @@ class executionModel extends model ->setIF($this->post->status == 'suspended' and $oldExecution->status != 'suspended', 'suspendedDate', helper::today()) ->setIF($oldExecution->type == 'stage', 'project', $oldExecution->project) ->setDefault('days', '0') + ->cleanINT('project') ->setDefault('team', $this->post->name) ->join('whitelist', ',') ->stripTags($this->config->execution->editor->edit['id'], $this->config->allowedTags) @@ -650,7 +652,7 @@ class executionModel extends model /* Update data. */ $this->lang->error->unique = $this->lang->error->repeat; - $executionProject = isset($execution->project) ? $execution->project : $oldExecution->project; + $executionProject = isset($execution->project) ? (int)$execution->project : $oldExecution->project; $this->dao->update(TABLE_EXECUTION)->data($execution) ->autoCheck($skipFields = 'begin,end') ->batchcheck($this->config->execution->edit->requiredFields, 'notempty') @@ -945,7 +947,7 @@ class executionModel extends model { $oldExecution = $oldExecutions[$executionID]; $team = $this->loadModel('user')->getTeamMemberPairs($executionID, 'execution'); - $projectID = isset($execution->project) ? $execution->project : $oldExecution->project; + $projectID = isset($execution->project) ? (int)$execution->project : $oldExecution->project; if(isset($execution->project)) { diff --git a/module/product/model.php b/module/product/model.php index 5c5e1bb46c..d4d6049a59 100755 --- a/module/product/model.php +++ b/module/product/model.php @@ -726,6 +726,7 @@ class productModel extends model ->setDefault('createdDate', helper::now()) ->setDefault('createdVersion', $this->config->version) ->setDefault('vision', $this->config->vision) + ->cleanINT('program,line') ->setIF($this->post->acl == 'open', 'whitelist', '') ->setIF(!isset($_POST['whitelist']), 'whitelist', '') ->stripTags($this->config->product->editor->create['id'], $this->config->allowedTags) @@ -739,7 +740,7 @@ class productModel extends model $product = $this->loadModel('file')->processImgURL($product, $this->config->product->editor->create['id'], $this->post->uid); /* Lean mode relation defaultProgram. */ - $programID = isset($product->program) ? $product->program : 0; + $programID = isset($product->program) ? (int)$product->program : 0; if($this->config->systemMode == 'light') { $programID = $this->config->global->defaultProgram; @@ -840,6 +841,7 @@ class productModel extends model ->setDefault('whitelist', '') ->setDefault('reviewer', '') ->setDefault('PMT', '') + ->cleanINT('program,line') ->join('whitelist', ',') ->join('reviewer', ',') ->join('PMT', ',') @@ -920,7 +922,7 @@ class productModel extends model foreach($products as $productID => $product) { $oldProduct = $oldProducts[$productID]; - if(in_array($this->config->systemMode, array('ALM', 'PLM'))) $programID = !isset($product->program) ? $oldProduct->program : (empty($product->program) ? 0 : $product->program); + if(in_array($this->config->systemMode, array('ALM', 'PLM'))) $programID = !isset($product->program) ? $oldProduct->program : zget($product, 'program', 0); $this->dao->update(TABLE_PRODUCT) ->data($product) diff --git a/module/program/model.php b/module/program/model.php index 69a1d86ea4..6f9fa5c84f 100644 --- a/module/program/model.php +++ b/module/program/model.php @@ -642,6 +642,7 @@ class programModel extends model ->setDefault('parent', 0) ->setDefault('code', '') ->setDefault('openedDate', helper::now()) + ->cleanINT('parent') ->setIF($this->post->acl == 'open', 'whitelist', '') ->setIF($this->post->delta == 999, 'end', LONG_TIME) ->setIF($this->post->budget != 0, 'budget', round((float)$this->post->budget, 2)) @@ -666,7 +667,7 @@ class programModel extends model ->checkIF($program->begin != '', 'begin', 'date') ->checkIF($program->end != '', 'end', 'date') ->checkIF($program->end != '', 'end', 'gt', $program->begin) - ->checkIF(!empty($program->name), 'name', 'unique', "`type`='program' and `parent` = $program->parent and `deleted` = '0'") + ->checkIF(!empty($program->name), 'name', 'unique', "`type`='program' and `parent` = " . $this->dao->sqlobj->quote($program->parent) . " and `deleted` = '0'") ->checkFlow() ->exec(); @@ -706,6 +707,7 @@ class programModel extends model ->setDefault('end', '') ->setDefault('lastEditedBy', $this->app->user->account) ->setDefault('lastEditedDate', helper::now()) + ->cleanINT('parent') ->setIF($this->post->begin == '0000-00-00', 'begin', '') ->setIF($this->post->end == '0000-00-00', 'end', '') ->setIF($this->post->delta == 999, 'end', LONG_TIME) @@ -746,7 +748,7 @@ class programModel extends model ->checkIF($program->begin != '', 'begin', 'date') ->checkIF($program->end != '', 'end', 'date') ->checkIF($program->end != '', 'end', 'gt', $program->begin) - ->checkIF(!empty($program->name), 'name', 'unique', "id!=$programID and `type`='program' and `parent` = $program->parent and `deleted` = '0'") + ->checkIF(!empty($program->name), 'name', 'unique', "id!=$programID and `type`='program' and `parent` = " . $this->dao->sqlobj->quote($program->parent) . " and `deleted` = '0'") ->checkFlow() ->where('id')->eq($programID) ->limit(1) diff --git a/module/project/model.php b/module/project/model.php index fa09894825..269f1afd10 100644 --- a/module/project/model.php +++ b/module/project/model.php @@ -1252,6 +1252,7 @@ class projectModel extends model ->setDefault('lastEditedBy', $this->app->user->account) ->setDefault('lastEditedDate', helper::now()) ->setDefault('days', '0') + ->cleanINT('parent') ->add('type', 'project') ->join('whitelist', ',') ->stripTags($this->config->project->editor->create['id'], $this->config->allowedTags) @@ -1353,8 +1354,8 @@ class projectModel extends model $this->dao->insert(TABLE_PROJECT)->data($project) ->autoCheck() ->batchcheck($requiredFields, 'notempty') - ->checkIF(!empty($project->name), 'name', 'unique', "`type`='project' and `parent` = $project->parent and `model` = '{$project->model}' and `deleted` = '0'") - ->checkIF(!empty($project->code), 'code', 'unique', "`type`='project' and `model` = '{$project->model}' and `deleted` = '0'") + ->checkIF(!empty($project->name), 'name', 'unique', "`type`='project' and `parent` = " . $this->dao->sqlobj->quote($project->parent) . " and `model` = " . $this->dao->sqlobj->quote($project->model) . " and `deleted` = '0'") + ->checkIF(!empty($project->code), 'code', 'unique', "`type`='project' and `model` = " . $this->dao->sqlobj->quote($project->model) . " and `deleted` = '0'") ->checkIF($project->end != '', 'end', 'gt', $project->begin) ->checkFlow() ->exec(); @@ -1534,6 +1535,7 @@ class projectModel extends model ->setDefault('lastEditedBy', $this->app->user->account) ->setDefault('lastEditedDate', helper::now()) ->setDefault('days', '0') + ->cleanINT('parent') ->setIF($this->post->delta == 999, 'end', LONG_TIME) ->setIF($this->post->delta == 999, 'days', 0) ->setIF($this->post->begin == '0000-00-00', 'begin', '') @@ -1606,8 +1608,8 @@ class projectModel extends model ->checkIF($project->begin != '', 'begin', 'date') ->checkIF($project->end != '', 'end', 'date') ->checkIF($project->end != '', 'end', 'gt', $project->begin) - ->checkIF(!empty($project->name), 'name', 'unique', "id != $projectID and `type` = 'project' and `parent` = '$oldProject->parent' and `model` = '{$project->model}' and `deleted` = '0'") - ->checkIF(!empty($project->code), 'code', 'unique', "id != $projectID and `type` = 'project' and `model` = '{$project->model}' and `deleted` = '0'") + ->checkIF(!empty($project->name), 'name', 'unique', "id != $projectID and `type` = 'project' and `parent` = '$oldProject->parent' and `model` = " . $this->dao->sqlobj->quote($project->model) . " and `deleted` = '0'") + ->checkIF(!empty($project->code), 'code', 'unique', "id != $projectID and `type` = 'project' and `model` = " . $this->dao->sqlobj->quote($project->model) . " and `deleted` = '0'") ->checkFlow() ->where('id')->eq($projectID) ->exec(); @@ -1757,7 +1759,7 @@ class projectModel extends model foreach($projects as $projectID => $project) { $oldProject = $oldProjects[$projectID]; - $parentID = !isset($project->parent) ? $oldProject->parent : $project->parent; + $parentID = !isset($project->parent) ? (int)$oldProject->parent : (int)$project->parent; $this->dao->update(TABLE_PROJECT)->data($project) ->autoCheck($skipFields = 'begin,end') @@ -1765,8 +1767,8 @@ class projectModel extends model ->checkIF($project->begin != '', 'begin', 'date') ->checkIF($project->end != '', 'end', 'date') ->checkIF($project->end != '', 'end', 'gt', $project->begin) - ->checkIF(!empty($project->name), 'name', 'unique', "id != $projectID and `type`='project' and `parent` = $parentID and `model` = '{$project->model}' and `deleted` = '0'") - ->checkIF(!empty($project->code), 'code', 'unique', "id != $projectID and `type`='project' and `model` = '{$project->model}' and `deleted` = '0'") + ->checkIF(!empty($project->name), 'name', 'unique', "id != $projectID and `type`='project' and `parent` = $parentID and `model` = " . $this->dao->sqlobj->quote($project->model) . " and `deleted` = '0'") + ->checkIF(!empty($project->code), 'code', 'unique', "id != $projectID and `type`='project' and `model` = " . $this->dao->sqlobj->quote($project->model) . " and `deleted` = '0'") ->checkFlow() ->where('id')->eq($projectID) ->exec(); diff --git a/module/repo/model.php b/module/repo/model.php index 20e9756514..0de3d06e2c 100644 --- a/module/repo/model.php +++ b/module/repo/model.php @@ -254,9 +254,9 @@ class repoModel extends model ->batchCheckIF($repo->SCM != 'Gitlab', 'path,client', 'notempty') ->batchCheckIF($isPipelineServer, 'serviceHost,serviceProject', 'notempty') ->batchCheckIF($repo->SCM == 'Subversion', $this->config->repo->svn->requiredFields, 'notempty') - ->check('name', 'unique', "`SCM` = '{$repo->SCM}'") - ->checkIF($isPipelineServer && $repo->serviceProject, 'serviceProject', 'unique', "`SCM` = '{$repo->SCM}' and `serviceHost` = '{$repo->serviceHost}'") - ->checkIF(!$isPipelineServer, 'path', 'unique', "`SCM` = '{$repo->SCM}' and `serviceHost` = '{$repo->serviceHost}'") + ->check('name', 'unique', "`SCM` = " . $this->dao->sqlobj->quote($repo->SCM)) + ->checkIF($isPipelineServer && $repo->serviceProject, 'serviceProject', 'unique', "`SCM` = " . $this->dao->sqlobj->quote($repo->SCM) . " and `serviceHost` = " . $this->dao->sqlobj->quote($repo->serviceHost)) + ->checkIF(!$isPipelineServer, 'path', 'unique', "`SCM` = " . $this->dao->sqlobj->quote($repo->SCM) . " and `serviceHost` = " . $this->dao->sqlobj->quote($repo->serviceHost)) ->autoCheck() ->exec(); @@ -292,8 +292,8 @@ class repoModel extends model $this->dao->insert(TABLE_REPO)->data($repo) ->batchCheck($this->config->repo->create->requiredFields, 'notempty') ->check('serviceHost,serviceProject', 'notempty') - ->check('name', 'unique', "`SCM` = '{$repo->SCM}'") - ->check('serviceProject', 'unique', "`SCM` = '{$repo->SCM}' and `serviceHost` = '{$repo->serviceHost}'") + ->check('name', 'unique', "`SCM` = " . $this->dao->sqlobj->quote($repo->serviceHost)) + ->check('serviceProject', 'unique', "`SCM` = " . $this->dao->sqlobj->quote($repo->SCM) . " and `serviceHost` = " . $this->dao->sqlobj->quote($repo->serviceHost)) ->autoCheck() ->exec(); @@ -366,9 +366,9 @@ class repoModel extends model ->batchCheckIF($data->SCM != 'Gitlab', 'path,client', 'notempty') ->batchCheckIF($isPipelineServer, 'serviceHost,serviceProject', 'notempty') ->batchCheckIF($data->SCM == 'Subversion', $this->config->repo->svn->requiredFields, 'notempty') - ->check('name', 'unique', "`SCM` = '{$data->SCM}' and `id` <> $id") - ->checkIF($isPipelineServer && $data->serviceProject, 'serviceProject', 'unique', "`SCM` = '{$data->SCM}' and `serviceHost` = '{$data->serviceHost}' and `id` <> $id") - ->checkIF(!$isPipelineServer, 'path', 'unique', "`SCM` = '{$data->SCM}' and `serviceHost` = '{$data->serviceHost}' and `id` <> $id") + ->check('name', 'unique', "`SCM` = " . $this->dao->sqlobj->quote($data->SCM) . " and `id` != $id") + ->checkIF($isPipelineServer && $data->serviceProject, 'serviceProject', 'unique', "`SCM` = " . $this->dao->sqlobj->quote($data->SCM) . " and `serviceHost` = " . $this->dao->sqlobj->quote($data->serviceHost) . " and `id` != $id") + ->checkIF(!$isPipelineServer, 'path', 'unique', "`SCM` = " . $this->dao->sqlobj->quote($data->SCM) . " and `serviceHost` = " . $this->dao->sqlobj->quote($data->serviceHost) . " and `id` != $id") ->autoCheck() ->where('id')->eq($id)->exec();