Changeset 720 for trunk/phpbms/common

Timestamp:

01/06/10 17:04:26 (2 years ago)

Author:

brieb

Message:

• fixed checkunique breaking with uuids and possible SQL injection
• fixed backslashes in searches
• fixed mark_as in invoice search commands incorrectly setting value to string 'NULL'

Files:

• trunk/phpbms/common/javascript/fields.js (modified) (1 diff)

trunk/phpbms/common/javascript/fields.js

@@ -237 +237 @@
 }
 
-function checkUnique(tabledefid,column,checkvalue,excludeid){
-
-        var theurl=APP_PATH+"checkunique.php?tdid="+parseInt(tabledefid);
-        theurl=theurl+"&c="+encodeURIComponent(column);
-        theurl=theurl+"&val="+encodeURIComponent(checkvalue);
-        theurl=theurl+"&xid="+parseInt(excludeid);
-
+function checkUnique(tabledefuuid , columnName, value, excludeuuid){
+
+        var theurl= APP_PATH + "checkunique.php?tduuid=" + encodeURIComponent(tabledefuuid);
+
+        theurl=theurl+"&cname="+encodeURIComponent(columnName);
+        theurl=theurl+"&value="+encodeURIComponent(value);
+        theurl=theurl+"&xuuid="+encodeURIComponent(excludeuuid);
 
         loadXMLDoc(theurl,null,false);
 
-        response = req.responseXML.documentElement;
-        thevalue = response.getElementsByTagName('isunique')[0].firstChild.data;
-
-        if(thevalue==1) return true; else return false;
-}
+        var isUnique = false;
+
+        try {
+
+            isUnique = eval("(" + req.responseText + ")")
+
+        } catch(err) {
+
+            isUnique = false;
+
+        }
+
+        return isUnique;
+
+}