Bugzilla – Attachment 14776 Details for
Bug 9454
NewBasket does not use placeholders in sql
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Proposed patch
0001-Bug-9454-Use-placeholders-when-adding-basket.patch (text/plain), 2.31 KB, created by
Colin Campbell
on 2013-01-23 11:43:33 UTC
(
hide
)
Description:
Proposed patch
Filename:
MIME Type:
Creator:
Colin Campbell
Created:
2013-01-23 11:43:33 UTC
Size:
2.31 KB
patch
obsolete
>From 5c09026583abe448a73a0f2ea92407a72578f52d Mon Sep 17 00:00:00 2001 >From: Colin Campbell <colin.campbell@ptfs-europe.com> >Date: Wed, 23 Jan 2013 10:52:28 +0000 >Subject: [PATCH] Bug 9454 Use placeholders when adding basket > >Should always use placeholders when passing variables >to DBI avoids unforeseen bugs and security issues >reformated the long lists of parameters to add CR >moved the setting of defaults out of the call to ModBasket to >clarify code >Setting parameters to undef if they were not defined >was unnecessary bloat and obscuration >--- > C4/Acquisition.pm | 25 ++++++++++++++----------- > 1 file changed, 14 insertions(+), 11 deletions(-) > >diff --git a/C4/Acquisition.pm b/C4/Acquisition.pm >index 4a03e2c..26cf796 100644 >--- a/C4/Acquisition.pm >+++ b/C4/Acquisition.pm >@@ -190,18 +190,21 @@ The other parameters are optional, see ModBasketHeader for more info on them. > =cut > > sub NewBasket { >- my ( $booksellerid, $authorisedby, $basketname, $basketnote, $basketbooksellernote, $basketcontractnumber, $deliveryplace, $billingplace ) = @_; >+ my ( $booksellerid, $authorisedby, $basketname, $basketnote, >+ $basketbooksellernote, $basketcontractnumber, $deliveryplace, >+ $billingplace ) = @_; > my $dbh = C4::Context->dbh; >- my $query = " >- INSERT INTO aqbasket >- (creationdate,booksellerid,authorisedby) >- VALUES (now(),'$booksellerid','$authorisedby') >- "; >- my $sth = >- $dbh->do($query); >-#find & return basketno MYSQL dependant, but $dbh->last_insert_id always returns null :-( >- my $basket = $dbh->{'mysql_insertid'}; >- ModBasketHeader($basket, $basketname || '', $basketnote || '', $basketbooksellernote || '', $basketcontractnumber || undef, $booksellerid, $deliveryplace || undef, $billingplace || undef ); >+ my $query = >+ 'INSERT INTO aqbasket (creationdate,booksellerid,authorisedby) ' >+ . 'VALUES (now(),?,?)'; >+ $dbh->do( $query, {}, $booksellerid, $authorisedby ); >+ >+ my $basket = $dbh->{mysql_insertid}; >+ $basketname ||= q{}; # default to empty strings >+ $basketnote ||= q{}; >+ $basketbooksellernote ||= q{}; >+ ModBasketHeader( $basket, $basketname, $basketnote, $basketbooksellernote, >+ $basketcontractnumber, $booksellerid, $deliveryplace, $billingplace ); > return $basket; > } > >-- >1.8.1.1.347.g9591fcc >
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 9454
:
14776
|
14924
|
15282