blackicedbear/FHC-Core
1
0
Fork 0
mirror of https://github.com/FH-Complete/FHC-Core.git synced 2026-07-23 09:52:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

- Method execReadOnlyQuery of DB_Model has a less strict check about the query statement

Browse Source 
- Added a first management of the type date
This commit is contained in:
Paolo
2017-12-05 17:39:31 +01:00
parent e6aba9a3e2
commit a7582c8868
3 changed files with 62 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
application/core/DB_Model.php
+16 -12
View File
@@ -694,21 +694,25 @@ class DB_Model extends FHC_Model
*/
public function execReadOnlyQuery($query, $parametersArray = null)
{
$result = error('You are allowed to run only query for reading data'); //
$cleanedQuery = trim(preg_replace('/\t|\n|\r|;/', '', $query)); //
//
if (!stripos($query, 'INSERT')
&& !stripos($query, 'UPDATE')
&& !stripos($query, 'DELETE')
&& !stripos($query, 'CREATE')
&& !stripos($query, 'ALTER')
&& !stripos($query, 'GRANT')
&& !stripos($query, 'DROP'))
if (stripos($cleanedQuery, 'SELECT') == 0
&& (stripos($cleanedQuery, 'INSERT') > 0 || stripos($cleanedQuery, 'INSERT') == false)
&& (stripos($cleanedQuery, 'UPDATE') > 0 || stripos($cleanedQuery, 'UPDATE') == false)
&& (stripos($cleanedQuery, 'CREATE') > 0 || stripos($cleanedQuery, 'CREATE') == false)
&& (stripos($cleanedQuery, 'DELETE') > 0 || stripos($cleanedQuery, 'DELETE') == false)
&& (stripos($cleanedQuery, 'ALTER') > 0 || stripos($cleanedQuery, 'ALTER') == false)
&& (stripos($cleanedQuery, 'GRANT') > 0 || stripos($cleanedQuery, 'GRANT') == false)
&& (stripos($cleanedQuery, 'DROP') > 0 || stripos($cleanedQuery, 'DROP') == false))
{
return $this->execQuery($query, $parametersArray);
}
else
{
return error('You are allowed to run only query for reading data');
$queryToExec = str_replace(';', '', $query); //
$result = $this->execQuery($queryToExec, $parametersArray);
}
return $result;
}
// ------------------------------------------------------------------------------------------