From 9e2df3dde2e7da1b368ca071a5ea05e98dbd62a1 Mon Sep 17 00:00:00 2001 From: wangyidong Date: Mon, 23 Jul 2018 17:27:54 +0800 Subject: [PATCH] * change for safe. --- module/bug/model.php | 4 ++-- module/build/model.php | 7 +++++-- module/doc/model.php | 2 +- module/product/model.php | 1 + module/project/model.php | 4 +++- module/release/model.php | 10 +++++++--- module/story/model.php | 2 +- 7 files changed, 20 insertions(+), 10 deletions(-) diff --git a/module/bug/model.php b/module/bug/model.php index 99f2b8b319..27c0f4b58d 100644 --- a/module/bug/model.php +++ b/module/bug/model.php @@ -927,8 +927,8 @@ class bugModel extends model if(dao::isError()) return false; $buildData = new stdclass(); - $buildData->product = $oldBug->product; - $buildData->branch = $oldBug->branch; + $buildData->product = (int)$oldBug->product; + $buildData->branch = (int)$oldBug->branch; $buildData->project = $bug->buildProject; $buildData->name = $bug->buildName; $buildData->date = date('Y-m-d'); diff --git a/module/build/model.php b/module/build/model.php index f40a24ddf4..cfcbd7796b 100644 --- a/module/build/model.php +++ b/module/build/model.php @@ -199,6 +199,7 @@ class buildModel extends model $build = fixer::input('post') ->setDefault('product', 0) ->setDefault('branch', 0) + ->cleanInt('product,branch') ->add('project', (int)$projectID) ->stripTags($this->config->build->editor->create['id'], $this->config->allowedTags) ->remove('resolvedBy,allchecker,files,labels,uid') @@ -230,8 +231,10 @@ class buildModel extends model */ public function update($buildID) { - $oldBuild = $this->dao->select('*')->from(TABLE_BUILD)->where('id')->eq((int)$buildID)->fetch(); + $buildID = (int)$buildID; + $oldBuild = $this->dao->select('*')->from(TABLE_BUILD)->where('id')->eq($buildID)->fetch(); $build = fixer::input('post')->stripTags($this->config->build->editor->edit['id'], $this->config->allowedTags) + ->cleanInt('product,branch') ->remove('allchecker,resolvedBy,files,labels,uid') ->get(); if(!isset($build->branch)) $build->branch = $oldBuild->branch; @@ -240,7 +243,7 @@ class buildModel extends model $this->dao->update(TABLE_BUILD)->data($build) ->autoCheck() ->batchCheck($this->config->build->edit->requiredFields, 'notempty') - ->where('id')->eq((int)$buildID) + ->where('id')->eq($buildID) ->check('name', 'unique', "id != $buildID AND product = {$build->product} AND branch = {$build->branch} AND deleted = '0'") ->exec(); if(isset($build->branch) and $oldBuild->branch != $build->branch) $this->dao->update(TABLE_RELEASE)->set('branch')->eq($build->branch)->where('build')->eq($buildID)->exec(); diff --git a/module/doc/model.php b/module/doc/model.php index d81b91560f..7b15723fff 100644 --- a/module/doc/model.php +++ b/module/doc/model.php @@ -606,7 +606,7 @@ class docModel extends model ->add('version', 1) ->setDefault('product,project,module', 0) ->stripTags($this->config->doc->editor->create['id'], $this->config->allowedTags) - ->cleanInt('product,project,module') + ->cleanInt('product,project,module,lib') ->join('groups', ',') ->join('users', ',') ->remove('files,labels,uid') diff --git a/module/product/model.php b/module/product/model.php index 28a9fb539e..e170f85ba9 100644 --- a/module/product/model.php +++ b/module/product/model.php @@ -433,6 +433,7 @@ class productModel extends model $oldProducts = $this->getByIdList($this->post->productIDList); foreach($data->productIDList as $productID) { + $productID = (int)$productID; $products[$productID] = new stdClass(); $products[$productID]->name = $data->names[$productID]; $products[$productID]->code = $data->codes[$productID]; diff --git a/module/project/model.php b/module/project/model.php index 14101e7eaa..ecd4abb46b 100644 --- a/module/project/model.php +++ b/module/project/model.php @@ -378,7 +378,8 @@ class projectModel extends model */ public function update($projectID) { - $oldProject = $this->dao->findById((int)$projectID)->from(TABLE_PROJECT)->fetch(); + $projectID = (int)$projectID; + $oldProject = $this->dao->findById($projectID)->from(TABLE_PROJECT)->fetch(); $team = $this->getTeamMemberPairs($projectID); $this->lang->project->team = $this->lang->project->teamname; $projectID = (int)$projectID; @@ -443,6 +444,7 @@ class projectModel extends model $oldProjects = $this->getByIdList($this->post->projectIDList); foreach($data->projectIDList as $projectID) { + $projectID = (int)$projectID; $projects[$projectID] = new stdClass(); $projects[$projectID]->name = $data->names[$projectID]; $projects[$projectID]->code = $data->codes[$projectID]; diff --git a/module/release/model.php b/module/release/model.php index 9373150af5..38e7d1e48a 100644 --- a/module/release/model.php +++ b/module/release/model.php @@ -103,7 +103,9 @@ class releaseModel extends model */ public function create($productID, $branch = 0) { - $buildID = 0; + $productID = (int)$productID; + $branch = (int)$branch; + $buildID = 0; if($this->post->build == false && $this->post->name) { $build = $this->dao->select('*')->from(TABLE_BUILD) @@ -186,11 +188,13 @@ class releaseModel extends model */ public function update($releaseID) { - $oldRelease = $this->dao->select('*')->from(TABLE_RELEASE)->where('id')->eq((int)$releaseID)->fetch(); - $branch = $this->dao->select('branch')->from(TABLE_BUILD)->where('id')->eq($this->post->build)->fetch('branch'); + $releaseID = (int)$releaseID; + $oldRelease = $this->dao->select('*')->from(TABLE_RELEASE)->where('id')->eq($releaseID)->fetch(); + $branch = $this->dao->select('branch')->from(TABLE_BUILD)->where('id')->eq((int)$this->post->build)->fetch('branch'); $release = fixer::input('post')->stripTags($this->config->release->editor->edit['id'], $this->config->allowedTags) ->add('branch', (int)$branch) + ->cleanInt('product'); ->remove('files,labels,allchecker,uid') ->get(); $release = $this->loadModel('file')->processImgURL($release, $this->config->release->editor->edit['id'], $this->post->uid); diff --git a/module/story/model.php b/module/story/model.php index e3edd5cdb1..ac96fb8eee 100644 --- a/module/story/model.php +++ b/module/story/model.php @@ -168,7 +168,7 @@ class storyModel extends model if($result['stop']) return array('status' => 'exists', 'id' => $result['duplicate']); if($this->checkForceReview()) $story->status = 'draft'; - if($story->status == 'draft') $story->stage = $this->post->plan > 0 ? 'planned' : 'wait'; + if($story->status == 'draft') $story->stage = $this->post->plan > 0 ? 'planned' : 'wait'; $story = $this->loadModel('file')->processImgURL($story, $this->config->story->editor->create['id'], $this->post->uid); $this->dao->insert(TABLE_STORY)->data($story, 'spec,verify')->autoCheck()->batchCheck($this->config->story->create->requiredFields, 'notempty')->exec(); if(!dao::isError())