Changeset 720 for trunk/phpbms/modules/bms/include/invoices.php

Timestamp:

01/06/10 17:04:26 (2 years ago)

Author:

brieb

Message:

• fixed checkunique breaking with uuids and possible SQL injection
• fixed backslashes in searches
• fixed mark_as in invoice search commands incorrectly setting value to string 'NULL'

Files:

• trunk/phpbms/modules/bms/include/invoices.php (modified) (4 diffs)

trunk/phpbms/modules/bms/include/invoices.php

@@ -816 +816 @@
                                 }//end if
 
-                                if(!in_array(((string)$variables["assignedtoid"]),$this->_availableUserUUIDs))
+                                if(!in_array(((string)$variables["assignedtoid"]), $this->_availableUserUUIDs))
                                         $this->verifyErrors[] = "The `assignedtoid` field does not give an existing/acceptable user id number.";
 
@@ -1556 +1556 @@
 
                                 if($therecord["defaultassignedtoid"]!="")
-                                        $assignedtoid = $therecord["defaultassignedtoid"];
+                                        $assignedtoid = "'".$therecord["defaultassignedtoid"]."'";
                                 else
                                         $assignedtoid="NULL";
@@ -1595 +1595 @@
                                         SET
                                                 invoices.statusdate=NOW(),
-                                                assignedtoid='".$assignedtoid."',
+                                                assignedtoid=".$assignedtoid.",
                                                 modifiedby=".$_SESSION["userinfo"]["id"].", ";
 
@@ -1627 +1627 @@
                                 $querystatement="INSERT INTO invoicestatushistory (invoiceid,invoicestatusid,statusdate,assignedtoid) values (";
                                 $querystatement.="'".$therecord["uuid"]."','".$statusid."',NOW(),";
-                                $querystatement.="'".$assignedtoid."'";
+                                $querystatement.= $assignedtoid;
                                 $querystatement.=")";
                                 $insertresult = $this->db->query($querystatement);