Design/EasySoft-ZenTaoPMS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 30 Wiki Activity

* Fixed security hole.

Browse Source
This commit is contained in:
z
2020-08-03 15:03:51 +08:00
parent 9a17e562d8
commit e5e1002f8a
1 changed files with 34 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
module/release/model.php
+34 -23
View File
@@ -119,28 +119,39 @@ class releaseModel extends model
/* Check date must be not more than today. */
if($this->post->date > date('Y-m-d')) return dao::$errors[] = $this->lang->release->errorDate;
$release = fixer::input('post')
->add('product', (int)$productID)
->add('branch', (int)$branch)
->setDefault('stories', '')
->cleanInt('build')
->join('stories', ',')
->join('bugs', ',')
->stripTags($this->config->release->editor->create['id'], $this->config->allowedTags)
->remove('allchecker,files,labels,uid')
->get();
/* Auto create build when release is not link build. */
if($this->post->build == false and $this->post->name)
if(empty($release->build) and $release->name)
{
$build = $this->dao->select('*')->from(TABLE_BUILD)
->where('deleted')->eq('0')
->andWhere('name')->eq($this->post->name)
->andWhere('name')->eq($release->name)
->andWhere('product')->eq($productID)
->andWhere('branch')->eq($branch)
->fetch();
if($build)
{
dao::$errors['build'] = sprintf($this->lang->release->existBuild, $this->post->name);
return dao::$errors['build'] = sprintf($this->lang->release->existBuild, $release->name);
}
else
{
$build = new stdclass();
$build->product = (int)$productID;
$build->branch = (int)$branch;
$build->name = $this->post->name;
$build->date = $this->post->date;
$build->name = $release->name;
$build->date = $release->date;
$build->builder = $this->app->user->account;
$build->desc = $this->post->desc;
$build->desc = $release->desc;
$build->project = 0;
$build = $this->loadModel('file')->processImgURL($build, $this->config->release->editor->create['id']);
@@ -149,21 +160,14 @@ class releaseModel extends model
->check('name', 'unique', "product = {$productID} AND branch = {$branch} AND deleted = '0'")
->batchCheck($this->config->release->create->requiredFields, 'notempty')
->exec();
if(dao::isError()) return false;
$buildID = $this->dao->lastInsertID();
$release->build = $buildID;
}
}
if($this->post->build) $branch = $this->dao->select('branch')->from(TABLE_BUILD)->where('id')->eq($this->post->build)->fetch('branch');
$release = fixer::input('post')
->add('product', (int)$productID)
->add('branch', (int)$branch)
->setDefault('stories', '')
->join('stories', ',')
->join('bugs', ',')
->setIF($this->post->build == false, 'build', $buildID)
->stripTags($this->config->release->editor->create['id'], $this->config->allowedTags)
->remove('allchecker,files,labels,uid')
->get();
if($release->build) $branch = $this->dao->select('branch')->from(TABLE_BUILD)->where('id')->eq($release->build)->fetch('branch');
$release = $this->loadModel('file')->processImgURL($release, $this->config->release->editor->create['id'], $this->post->uid);
$this->dao->insert(TABLE_RELEASE)->data($release)
@@ -173,7 +177,7 @@ class releaseModel extends model
if(dao::isError())
{
if($buildID) $this->dao->delete()->from(TABLE_BUILD)->where('id')->eq($buildID)->exec();
if(!empty($buildID)) $this->dao->delete()->from(TABLE_BUILD)->where('id')->eq($buildID)->exec();
return false;
}
@@ -181,7 +185,7 @@ class releaseModel extends model
if(dao::isError())
{
if($buildID) $this->dao->delete()->from(TABLE_BUILD)->where('id')->eq($buildID)->exec();
if(!empty($buildID)) $this->dao->delete()->from(TABLE_BUILD)->where('id')->eq($buildID)->exec();
}
else
{
@@ -246,6 +250,7 @@ class releaseModel extends model
if($release->stories)
{
$this->loadModel('story');
$this->loadModel('action');
foreach($this->post->stories as $storyID)
{
/* Reset story stagedBy field for auto compute stage. */
@@ -254,7 +259,7 @@ class releaseModel extends model
$this->story->setStage($storyID);
$this->loadModel('action')->create('story', $storyID, 'linked2release', '', $releaseID);
$this->action->create('story', $storyID, 'linked2release', '', $releaseID);
}
}
}
@@ -292,9 +297,11 @@ class releaseModel extends model
foreach($storyList as $storyID) $release->stories = str_replace(",$storyID,", ',', $release->stories);
$release->stories = trim($release->stories, ',');
$this->dao->update(TABLE_RELEASE)->set('stories')->eq($release->stories)->where('id')->eq((int)$releaseID)->exec();
$this->loadModel('action');
foreach($this->post->storyIdList as $unlinkStoryID)
{
$this->loadModel('action')->create('story', $unlinkStoryID, 'unlinkedfromrelease', '', $releaseID);
$this->action->create('story', $unlinkStoryID, 'unlinkedfromrelease', '', $releaseID);
}
}
@@ -313,9 +320,11 @@ class releaseModel extends model
$field = $type == 'bug' ? 'bugs' : 'leftBugs';
$release->$field .= ',' . join(',', $this->post->bugs);
$this->dao->update(TABLE_RELEASE)->set($field)->eq($release->$field)->where('id')->eq((int)$releaseID)->exec();
$this->loadModel('action');
foreach($this->post->bugs as $bugID)
{
$this->loadModel('action')->create('bug', $bugID, 'linked2release', '', $releaseID);
$this->action->create('bug', $bugID, 'linked2release', '', $releaseID);
}
}
@@ -357,9 +366,11 @@ class releaseModel extends model
foreach($bugList as $bugID) $release->$field = str_replace(",$bugID,", ',', $release->$field);
$release->$field = trim($release->$field, ',');
$this->dao->update(TABLE_RELEASE)->set($field)->eq($release->$field)->where('id')->eq((int)$releaseID)->exec();
$this->loadModel('action');
foreach($this->post->unlinkBugs as $unlinkBugID)
{
$this->loadModel('action')->create('bug', $unlinkBugID, 'unlinkedfromrelease', '', $releaseID);
$this->action->create('bug', $unlinkBugID, 'unlinkedfromrelease', '', $releaseID);
}
}