ChangeSet ID: 26193
CVSROOT: /opt/cvs-commit
Module name: appdb
Changes by: wineowner(a)winehq.org 2006/07/04 01:19:06
Modified files:
include : db.php
Log message:
Chris Morgan <cmorgan(a)alum.wpi.edu>
query_parameters() usage example and the rule that all variables should be passed as parameters
Patch: http://cvs.winehq.org/patch.py?id=26193
Old revision New revision Changes Path
1.17 1.18 +8 -0 appdb/include/db.php
Index: appdb/include/db.php
diff -u -p appdb/include/db.php:1.17 appdb/include/db.php:1.18
--- appdb/include/db.php:1.17 4 Jul 2006 6:19: 6 -0000
+++ appdb/include/db.php 4 Jul 2006 6:19: 6 -0000
@@ -36,6 +36,14 @@ function query_appdb($sQuery,$sComment="
* Values are mysql_real_escape_string()'d to prevent against injection attacks
* See http://php.net/mysql_real_escape_string for more information about why this is the case
*
+ * Usage:
+ * $hResult = query_parameters("Select * from mytable where userid = '?'",
+ * $iUserId);
+ *
+ * Note:
+ * Ensure that all variables are passed as parameters to query_parameters()
+ * to ensure that sql injection attacks are prevented against
+ *
*/
function query_parameters()
{
ChangeSet ID: 26192
CVSROOT: /opt/cvs-commit
Module name: appdb
Changes by: wineowner(a)winehq.org 2006/07/03 22:43:06
Modified files:
include : application.php bugs.php db.php
distributions.php testResults.php
Log message:
Chris Morgan <cmorgan(a)alum.wpi.edu>
Stop using compile_update_string(). compile_update_string() can be passed a value that includes a character considered
special by query_parameters(). We then use the output from compile_update_string() as a part of the first
parameter to query_parameters(), the format string. Having extra special characters causes a token mismatch
and query_parameters() will reject the queries entirely. Remove now unused compile_update_string().
Patch: http://cvs.winehq.org/patch.py?id=26192
Old revision New revision Changes Path
1.54 1.55 +18 -28 appdb/include/application.php
1.11 1.12 +2 -3 appdb/include/bugs.php
1.16 1.17 +0 -29 appdb/include/db.php
1.8 1.9 +2 -4 appdb/include/distributions.php
1.27 1.28 +24 -13 appdb/include/testResults.php
ChangeSet ID: 26190
CVSROOT: /opt/cvs-commit
Module name: appdb
Changes by: wineowner(a)winehq.org 2006/07/03 21:24:56
Modified files:
include : application.php
Log message:
Chris Morgan <cmorgan(a)alum.wpi.edu>
Add in missing & between url parameters
Patch: http://cvs.winehq.org/patch.py?id=26190
Old revision New revision Changes Path
1.53 1.54 +1 -1 appdb/include/application.php
Index: appdb/include/application.php
diff -u -p appdb/include/application.php:1.53 appdb/include/application.php:1.54
--- appdb/include/application.php:1.53 4 Jul 2006 2:24:56 -0000
+++ appdb/include/application.php 4 Jul 2006 2:24:56 -0000
@@ -333,7 +333,7 @@ class Application {
$sMsg = "The application you submitted (".$oApp->sName." ".$this->sName.") has been rejected.";
$sMsg .= "Clicking on the link in this email will allow you to modify and resubmit the application. ";
$sMsg .= "A link to your queue of applications and versions will also show up on the left hand side of the Appdb site once you have logged in. ";
- $sMsg .= APPDB_ROOT."appsubmit.php?sub=view&apptype=applicationappId=".$this->iAppId."\n";
+ $sMsg .= APPDB_ROOT."appsubmit.php?sub=view&apptype=application&appId=".$this->iAppId."\n";
$sMsg .= "Reason given:\n";
break;
case "delete":