AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-08-05 07:07:14 +00:00
Code Issues Packages Projects Releases Wiki Activity

Reworked getFieldById to remove escaping and and reworked everything that uses the function to also escape, was causing double escaping in many places this standardizes the function

Browse Source
This commit is contained in:
johnnyq
2026-08-01 15:33:48 -04:00
parent 75028ba09a
commit 23a09f54fc
8 changed files with 56 additions and 80 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
admin/post/contract_template.php
View File

@@ -116,7 +116,7 @@ if (isset($_GET['archive_contract_template'])) {
$contract_template_id = intval($_GET['archive_contract_template']);
$name = getFieldById('contract_templates', $contract_template_id, 'contract_template_name');
$name = escapeSql(getFieldById('contract_templates', $contract_template_id, 'contract_template_name'));
mysqli_query($mysqli, "
UPDATE contract_templates SET contract_template_archived_at = NOW()
@@ -135,7 +135,7 @@ if (isset($_GET['restore_contract_template'])) {
$contract_template_id = intval($_GET['restore_contract_template']);
$name = getFieldById('contract_templates', $contract_template_id, 'contract_template_name');
$name = escapeSql(getFieldById('contract_templates', $contract_template_id, 'contract_template_name'));
mysqli_query($mysqli, "
UPDATE contract_templates SET contract_template_archived_at = NULL
@@ -154,7 +154,7 @@ if (isset($_GET['delete_contract_template'])) {
$contract_template_id = intval($_GET['delete_contract_template']);
$name = getFieldById('contract_templates', $contract_template_id, 'contract_template_name');
$name = escapeSql(getFieldById('contract_templates', $contract_template_id, 'contract_template_name'));
mysqli_query($mysqli, "
DELETE FROM contract_templates

2
admin/post/users.php
View File

@@ -278,7 +278,7 @@ if (isset($_POST['archive_user'])) {
mysqli_query($mysqli, "UPDATE tickets SET ticket_assigned_to = $ticket_assign WHERE ticket_assigned_to = $user_id AND ticket_closed_at IS NULL AND ticket_resolved_at IS NULL");
mysqli_query($mysqli, "UPDATE recurring_tickets SET recurring_ticket_assigned_to = $ticket_assign WHERE recurring_ticket_assigned_to = $user_id");
$reassigned_to_name = $ticket_assign ? escapeSql(getFieldById('users', $ticket_assign, 'user_name', 'raw')) : '';
$reassigned_to_name = $ticket_assign ? escapeSql(getFieldById('users', $ticket_assign, 'user_name')) : '';
foreach ($affected_ticket_ids as $affected_ticket_id) {
if ($reassigned_to_name) {
logTicketHistory($affected_ticket_id, "$session_name reassigned the ticket to $reassigned_to_name when $user_name was archived");