r100306 MediaWiki - Code Review archive

Repository:MediaWiki
Revision:r100305‎ | r100306 | r100307 >
Date:00:45, 20 October 2011
Author:johnduhart
Status:ok
Tags:
Comment:
Followup r100165, fix SQL injections and conditions
Modified paths:
  • /trunk/extensions/CheckUser/api/ApiQueryCheckUser.php (modified) (history)
  • /trunk/extensions/CheckUser/api/ApiQueryCheckUserLog.php (modified) (history)

Diff [purge]

Index: trunk/extensions/CheckUser/api/ApiQueryCheckUser.php
@@ -46,7 +46,7 @@
4747 }
4848
4949 $this->addFields( array( 'cuc_timestamp', 'cuc_ip', 'cuc_xff' ) );
50 - $this->addWhere( "cuc_user_text = '$target'" );
 50+ $this->addWhereFld( 'cuc_user_text', $target );
5151 $res = $this->select( __METHOD__ );
5252 $result = $this->getResult();
5353
@@ -84,21 +84,21 @@
8585 if ( !$cond ) {
8686 $this->dieUsage( 'IP or range is invalid', 'invalidip' );
8787 }
88 - $this->addWhere( "$cond" );
 88+ $this->addWhere( $cond );
8989 $log_type = array( 'ipedits-xff', 'ip' );
9090 } elseif ( IP::isIPAddress( $target ) ) {
9191 $cond = CheckUser::getIpConds( $db, $target );
9292 if ( !$cond ) {
9393 $this->dieUsage( 'IP or range is invalid', 'invalidip' );
9494 }
95 - $this->addWhere( "$cond" );
 95+ $this->addWhere( $cond );
9696 $log_type = array( 'ipedits', 'ip' );
9797 } else {
9898 $user_id = User::idFromName( $target );
9999 if ( !$user_id ) {
100100 $this->dieUsage( 'Target user is not exists', 'nosuchuser' );
101101 }
102 - $this->addWhere( "cuc_user_text = '$target'" );
 102+ $this->addWhereFld( 'cuc_user_text', $target );
103103 $log_type = array( 'useredits', 'user' );
104104 }
105105
Index: trunk/extensions/CheckUser/api/ApiQueryCheckUserLog.php
@@ -25,24 +25,16 @@
2626
2727 $this->addTables( 'cu_log' );
2828 $this->addOption( 'LIMIT', $limit + 1 );
29 - $this->addOption( 'ORDER BY', 'cul_timestamp DESC' );
 29+ $this->addWhereRange( 'cul_timestamp', 'older', $from, $to );
3030
3131 $this->addFields( array( 'cul_timestamp', 'cul_user_text', 'cul_reason', 'cul_type', 'cul_target_text' ) );
3232
3333 if ( isset( $user ) ) {
34 - $this->addWhere( "cul_user_text = '$user'" );
 34+ $this->addWhereFld( 'cul_user_text', $user );
3535 }
3636 if ( isset( $target ) ) {
37 - $this->addWhere( "cul_target_text = '$target'" );
 37+ $this->addWhereFld( 'cul_target_text', $target );
3838 }
39 - if ( isset( $from ) && isset( $to ) ) {
40 - $this->addWhere( "cul_timestamp BETWEEN '$from' AND '$to'" );
41 - unset( $from, $to );
42 - } elseif ( isset( $from ) ) {
43 - $this->addWhere( "cul_timestamp < $from" );
44 - } elseif ( isset( $to ) ) {
45 - $this->addWhere( "cul_timestamp > $to" );
46 - }
4739
4840 $res = $this->select( __METHOD__ );
4941 $result = $this->getResult();

Past revisions this follows-up on

RevisionCommit summaryAuthorDate
r100165Adds API Module by cryptocoryne...johnduhart21:37, 18 October 2011

Status & tagging log