Changeset 720 for trunk/phpbms/modules

Timestamp:

01/06/10 17:04:26 (2 years ago)

Author:

brieb

Message:

• fixed checkunique breaking with uuids and possible SQL injection
• fixed backslashes in searches
• fixed mark_as in invoice search commands incorrectly setting value to string 'NULL'

Location:

trunk/phpbms/modules/bms

Files:

• include/invoices.php (modified) (4 diffs)
• javascript/product.js (modified) (1 diff)

trunk/phpbms/modules/bms/include/invoices.php

@@ -816 +816 @@
                                 }//end if
 
-                                if(!in_array(((string)$variables["assignedtoid"]),$this->_availableUserUUIDs))
+                                if(!in_array(((string)$variables["assignedtoid"]), $this->_availableUserUUIDs))
                                         $this->verifyErrors[] = "The `assignedtoid` field does not give an existing/acceptable user id number.";
 
@@ -1556 +1556 @@
 
                                 if($therecord["defaultassignedtoid"]!="")
-                                        $assignedtoid = $therecord["defaultassignedtoid"];
+                                        $assignedtoid = "'".$therecord["defaultassignedtoid"]."'";
                                 else
                                         $assignedtoid="NULL";
@@ -1595 +1595 @@
                                         SET
                                                 invoices.statusdate=NOW(),
-                                                assignedtoid='".$assignedtoid."',
+                                                assignedtoid=".$assignedtoid.",
                                                 modifiedby=".$_SESSION["userinfo"]["id"].", ";
 
@@ -1627 +1627 @@
                                 $querystatement="INSERT INTO invoicestatushistory (invoiceid,invoicestatusid,statusdate,assignedtoid) values (";
                                 $querystatement.="'".$therecord["uuid"]."','".$statusid."',NOW(),";
-                                $querystatement.="'".$assignedtoid."'";
+                                $querystatement.= $assignedtoid;
                                 $querystatement.=")";
                                 $insertresult = $this->db->query($querystatement);

trunk/phpbms/modules/bms/javascript/product.js

@@ -81 +81 @@
 
         var partnumber = getObjectFromID("partnumber");
-        var excludeid = getObjectFromID("id");
-
-        if(!checkUnique(4, "partnumber", partnumber.value, parseInt(excludeid.value))){
+        var excludeid = getObjectFromID("uuid");
+
+        if(!checkUnique('tbld:7a9e87ed-d165-c4a4-d9b9-0a4adc3c5a34', "partnumber", partnumber.value, excludeid.value)){
 
             alert("Part number must be unique.");