Attachment 15282 Details for Bug 9454 – Bug 9454: Use placeholders when adding basket

[patch] Bug 9454: Use placeholders when adding basket

Bug-9454-Use-placeholders-when-adding-basket.patch (text/plain), 2.77 KB, created by Katrin Fischer on 2013-02-12 20:59:26 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Katrin Fischer

Created: 2013-02-12 20:59:26 UTC

Size: 2.77 KB

patch

obsolete

>From 8011ac1eb985d50184741752991251a2b30352a4 Mon Sep 17 00:00:00 2001
>From: Colin Campbell <colin.campbell@ptfs-europe.com>
>Date: Wed, 23 Jan 2013 10:52:28 +0000
>Subject: [PATCH] Bug 9454: Use placeholders when adding basket
>
>Should always use placeholders when passing variables
>to DBI; avoids unforeseen bugs and security issues.
>
>Also:
>
>- reformated the long lists of parameters to add CR
>- moved the setting of defaults out of the call to ModBasket to
>  clarify code
>- Setting parameters to undef if they were not defined
>  was unnecessary bloat and obscuration
>
>Testing:
>Patch should not change functional behaviour. To test check that
>order baskets can still be correctly created.
>
>Signed-off-by: Galen Charlton <gmc@esilibrary.com>
>Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
>All tests and QA script pass.
>Created a new basket, added order lines and closed basket.
>Checked everything worked in the staff interface, also checked
>the entry for the new basket in aqbasket in the database.
>Logs are clean too.
>---
> C4/Acquisition.pm |   25 ++++++++++++++-----------
> 1 file changed, 14 insertions(+), 11 deletions(-)
>
>diff --git a/C4/Acquisition.pm b/C4/Acquisition.pm
>index 249f10d..376a20b 100644
>--- a/C4/Acquisition.pm
>+++ b/C4/Acquisition.pm
>@@ -190,18 +190,21 @@ The other parameters are optional, see ModBasketHeader for more info on them.
> =cut
> 
> sub NewBasket {
>-    my ( $booksellerid, $authorisedby, $basketname, $basketnote, $basketbooksellernote, $basketcontractnumber, $deliveryplace, $billingplace ) = @_;
>+    my ( $booksellerid, $authorisedby, $basketname, $basketnote,
>+        $basketbooksellernote, $basketcontractnumber, $deliveryplace,
>+        $billingplace ) = @_;
>     my $dbh = C4::Context->dbh;
>-    my $query = "
>-        INSERT INTO aqbasket
>-                (creationdate,booksellerid,authorisedby)
>-        VALUES  (now(),'$booksellerid','$authorisedby')
>-    ";
>-    my $sth =
>-    $dbh->do($query);
>-#find & return basketno MYSQL dependant, but $dbh->last_insert_id always returns null :-(
>-    my $basket = $dbh->{'mysql_insertid'};
>-    ModBasketHeader($basket, $basketname || '', $basketnote || '', $basketbooksellernote || '', $basketcontractnumber || undef, $booksellerid, $deliveryplace || undef, $billingplace || undef );
>+    my $query =
>+        'INSERT INTO aqbasket (creationdate,booksellerid,authorisedby) '
>+      . 'VALUES  (now(),?,?)';
>+    $dbh->do( $query, {}, $booksellerid, $authorisedby );
>+
>+    my $basket = $dbh->{mysql_insertid};
>+    $basketname           ||= q{}; # default to empty strings
>+    $basketnote           ||= q{};
>+    $basketbooksellernote ||= q{};
>+    ModBasketHeader( $basket, $basketname, $basketnote, $basketbooksellernote,
>+        $basketcontractnumber, $booksellerid, $deliveryplace, $billingplace );
>     return $basket;
> }
> 
>-- 
>1.7.9.5

Actions: View | Diff | Splinter Review

Attachments on bug 9454: 14776 | 14924 | 15282