AS1024/Kanboard-Prod
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix(mssql): use picodb ORM for subtask timer query, rather than hardcoded SQL

Browse Source 
the hardcoded SQL was failing on MSSQL because 'end' is a reserved keyword
and thus must be escaped
escape identifiers within subtask timer subquery conditions
serialize and interpolate values into text after generation
This commit is contained in:
Joe Nahmias
2022-07-10 19:35:33 -04:00
committed by Frédéric Guillot
parent c39932050c
commit 70bc427470
1 changed files with 14 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
app/Model/SubtaskTimeTrackingModel.php
View File

@@ -29,16 +29,20 @@ class SubtaskTimeTrackingModel extends Base
*/ */
public function getTimerQuery($user_id) public function getTimerQuery($user_id)
{ {
return sprintf( $sql = $this->db
"SELECT %s FROM %s WHERE %s='%d' AND %s='0' AND %s=%s LIMIT 1", ->table(self::TABLE)
$this->db->escapeIdentifier('start'), ->columns('start')
$this->db->escapeIdentifier(self::TABLE), ->eq($this->db->escapeIdentifier('user_id',self::TABLE), $user_id)
$this->db->escapeIdentifier('user_id'), ->eq($this->db->escapeIdentifier('end',self::TABLE), 0)
$user_id, ->eq($this->db->escapeIdentifier('subtask_id',self::TABLE), SubtaskModel::TABLE.'.id')
$this->db->escapeIdentifier('end'), ->limit(1)
$this->db->escapeIdentifier('subtask_id'), ->buildSelectQuery();
SubtaskModel::TABLE.'.id' // need to interpolate values into the SQL text for use as a subquery
); // in SubtaskModel::getQuery()
$sql = substr_replace($sql, $user_id, strpos($sql, '?'), 1);
$sql = substr_replace($sql, 0, strpos($sql, '?'), 1);
$sql = substr_replace($sql, SubtaskModel::TABLE.'.id', strpos($sql, '?'), 1);
return $sql;
} }
/** /**