|
Lines 85-92
sub dt_build_orderby {
Link Here
|
| 85 |
my $param = shift; |
85 |
my $param = shift; |
| 86 |
|
86 |
|
| 87 |
my $i = 0; |
87 |
my $i = 0; |
| 88 |
my $orderby; |
|
|
| 89 |
my @orderbys; |
88 |
my @orderbys; |
|
|
89 |
my $dbh = C4::Context->dbh; |
| 90 |
while(exists $param->{'iSortCol_'.$i}){ |
90 |
while(exists $param->{'iSortCol_'.$i}){ |
| 91 |
my $iSortCol = $param->{'iSortCol_'.$i}; |
91 |
my $iSortCol = $param->{'iSortCol_'.$i}; |
| 92 |
my $sSortDir = $param->{'sSortDir_'.$i}; |
92 |
my $sSortDir = $param->{'sSortDir_'.$i}; |
|
Lines 105-113
sub dt_build_orderby {
Link Here
|
| 105 |
return unless @orderbys; |
105 |
return unless @orderbys; |
| 106 |
|
106 |
|
| 107 |
# Must be "branches.branchname asc", "borrowers.firstname desc", etc. |
107 |
# Must be "branches.branchname asc", "borrowers.firstname desc", etc. |
| 108 |
@orderbys = grep { /^\w+\.\w+\s(asc|desc)$/ } @orderbys; |
108 |
@orderbys = grep { /^\w+\.\w+ (asc|desc)$/ } @orderbys; |
|
|
109 |
|
| 110 |
my @sanitized_orderbys; |
| 111 |
for my $orderby (@orderbys) { |
| 112 |
my ($identifier, $direction) = split / /, $orderby, 2; |
| 113 |
my ($table, $column) = split /\./, $identifier, 2; |
| 114 |
my $sanitized_identifier = $dbh->quote_identifier(undef, $table, $column); |
| 115 |
my $sanitized_direction = $direction eq 'asc' ? 'ASC' : 'DESC'; |
| 116 |
push @sanitized_orderbys, "$sanitized_identifier $sanitized_direction"; |
| 117 |
} |
| 109 |
|
118 |
|
| 110 |
$orderby = " ORDER BY " . join(',', @orderbys) . " " if @orderbys; |
119 |
my $orderby = " ORDER BY " . join(',', @sanitized_orderbys) . " " if @sanitized_orderbys; |
| 111 |
return $orderby; |
120 |
return $orderby; |
| 112 |
} |
121 |
} |
| 113 |
|
122 |
|