* change for safe.

module/bug/model.php

@@ -927,8 +927,8 @@ class bugModel extends model
             if(dao::isError()) return false;
 
             $buildData = new stdclass();
-            $buildData->product = $oldBug->product;
-            $buildData->branch  = $oldBug->branch;
+            $buildData->product = (int)$oldBug->product;
+            $buildData->branch  = (int)$oldBug->branch;
             $buildData->project = $bug->buildProject;
             $buildData->name    = $bug->buildName;
             $buildData->date    = date('Y-m-d');

module/build/model.php

@@ -199,6 +199,7 @@ class buildModel extends model
         $build = fixer::input('post')
             ->setDefault('product', 0)
             ->setDefault('branch', 0)
+            ->cleanInt('product,branch')
             ->add('project', (int)$projectID)
             ->stripTags($this->config->build->editor->create['id'], $this->config->allowedTags)
             ->remove('resolvedBy,allchecker,files,labels,uid')
@@ -230,8 +231,10 @@ class buildModel extends model
      */
     public function update($buildID)
     {
-        $oldBuild = $this->dao->select('*')->from(TABLE_BUILD)->where('id')->eq((int)$buildID)->fetch();
+        $buildID  = (int)$buildID;
+        $oldBuild = $this->dao->select('*')->from(TABLE_BUILD)->where('id')->eq($buildID)->fetch();
         $build    = fixer::input('post')->stripTags($this->config->build->editor->edit['id'], $this->config->allowedTags)
+            ->cleanInt('product,branch')
             ->remove('allchecker,resolvedBy,files,labels,uid')
             ->get();
         if(!isset($build->branch)) $build->branch = $oldBuild->branch;
@@ -240,7 +243,7 @@ class buildModel extends model
         $this->dao->update(TABLE_BUILD)->data($build)
             ->autoCheck()
             ->batchCheck($this->config->build->edit->requiredFields, 'notempty')
-            ->where('id')->eq((int)$buildID)
+            ->where('id')->eq($buildID)
             ->check('name', 'unique', "id != $buildID AND product = {$build->product} AND branch = {$build->branch} AND deleted = '0'")
             ->exec();
         if(isset($build->branch) and $oldBuild->branch != $build->branch) $this->dao->update(TABLE_RELEASE)->set('branch')->eq($build->branch)->where('build')->eq($buildID)->exec();

module/doc/model.php

@@ -606,7 +606,7 @@ class docModel extends model
             ->add('version', 1)
             ->setDefault('product,project,module', 0)
             ->stripTags($this->config->doc->editor->create['id'], $this->config->allowedTags)
-            ->cleanInt('product,project,module')
+            ->cleanInt('product,project,module,lib')
             ->join('groups', ',')
             ->join('users', ',')
             ->remove('files,labels,uid')

module/product/model.php

@@ -433,6 +433,7 @@ class productModel extends model
         $oldProducts = $this->getByIdList($this->post->productIDList);
         foreach($data->productIDList as $productID)
         {
+            $productID = (int)$productID;
             $products[$productID] = new stdClass();
             $products[$productID]->name   = $data->names[$productID];
             $products[$productID]->code   = $data->codes[$productID];

module/project/model.php

@@ -378,7 +378,8 @@ class projectModel extends model
      */
     public function update($projectID)
     {
-        $oldProject = $this->dao->findById((int)$projectID)->from(TABLE_PROJECT)->fetch();
+        $projectID  = (int)$projectID;
+        $oldProject = $this->dao->findById($projectID)->from(TABLE_PROJECT)->fetch();
         $team = $this->getTeamMemberPairs($projectID);
         $this->lang->project->team = $this->lang->project->teamname;
         $projectID = (int)$projectID;
@@ -443,6 +444,7 @@ class projectModel extends model
         $oldProjects = $this->getByIdList($this->post->projectIDList);
         foreach($data->projectIDList as $projectID)
         {
+            $projectID = (int)$projectID;
             $projects[$projectID] = new stdClass();
             $projects[$projectID]->name   = $data->names[$projectID];
             $projects[$projectID]->code   = $data->codes[$projectID];

module/release/model.php

@@ -103,7 +103,9 @@ class releaseModel extends model
      */
     public function create($productID, $branch = 0)
     {
-        $buildID = 0;
+        $productID = (int)$productID;
+        $branch    = (int)$branch;
+        $buildID   = 0;
         if($this->post->build == false && $this->post->name)
         {
             $build = $this->dao->select('*')->from(TABLE_BUILD)
@@ -186,11 +188,13 @@ class releaseModel extends model
      */
     public function update($releaseID)
     {
-        $oldRelease = $this->dao->select('*')->from(TABLE_RELEASE)->where('id')->eq((int)$releaseID)->fetch();
-        $branch     = $this->dao->select('branch')->from(TABLE_BUILD)->where('id')->eq($this->post->build)->fetch('branch');
+        $releaseID  = (int)$releaseID;
+        $oldRelease = $this->dao->select('*')->from(TABLE_RELEASE)->where('id')->eq($releaseID)->fetch();
+        $branch     = $this->dao->select('branch')->from(TABLE_BUILD)->where('id')->eq((int)$this->post->build)->fetch('branch');
 
         $release = fixer::input('post')->stripTags($this->config->release->editor->edit['id'], $this->config->allowedTags)
             ->add('branch',  (int)$branch)
+            ->cleanInt('product');
             ->remove('files,labels,allchecker,uid')
             ->get();
         $release = $this->loadModel('file')->processImgURL($release, $this->config->release->editor->edit['id'], $this->post->uid);

module/story/model.php

@@ -168,7 +168,7 @@ class storyModel extends model
         if($result['stop']) return array('status' => 'exists', 'id' => $result['duplicate']);
 
         if($this->checkForceReview()) $story->status = 'draft';
-        if($story->status == 'draft') $story->stage   = $this->post->plan > 0 ? 'planned' : 'wait';
+        if($story->status == 'draft') $story->stage  = $this->post->plan > 0 ? 'planned' : 'wait';
         $story = $this->loadModel('file')->processImgURL($story, $this->config->story->editor->create['id'], $this->post->uid);
         $this->dao->insert(TABLE_STORY)->data($story, 'spec,verify')->autoCheck()->batchCheck($this->config->story->create->requiredFields, 'notempty')->exec();
         if(!dao::isError())