Congegni/sintonia
7
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

CC-5121 : fix some SQL statements not being escaped/prepared

Browse source
This commit is contained in:
Naomi 2013-05-10 17:14:10 -04:00
parent 987537fbdc
commit b0018083c7
2 changed files with 82 additions and 33 deletions
Download patch file Download diff file Expand all files Collapse all files

11
airtime_mvc/application/models/Block.php
View file

@ -1005,10 +1005,12 @@ SQL;
public static function getBlockCount()
{
$con = Propel::getConnection();
$sql = 'SELECT count(*) as cnt FROM cc_playlist';
$res = Application_Common_Database::prepareAndExecute($sql, array(),
Application_Common_Database::COLUMN);
return $con->query($sql)->fetchColumn(0);
return $res;
}
/**
@ -1546,12 +1548,13 @@ SQL;
}
public static function getAllBlockFiles()
{
$con = Propel::getConnection();
$sql = <<<SQL
SELECT distinct(file_id)
FROM cc_blockcontents
SQL;
$files = $con->query($sql)->fetchAll();
$files = Application_Common_Database::prepareAndExecute($sql, array());
$real_files = array();
foreach ($files as $f) {
$real_files[] = $f['file_id'];