r58447 MediaWiki - Code Review archive

Repository:MediaWiki
Revision:r58446‎ | r58447 | r58448 >
Date:22:41, 2 November 2009
Author:nimishg
Status:deferred
Tags:
Comment:
Added stricter checking for min and max dates, escaped dates, removed subqueries (as they aren't supported in MySQL 4)
Modified paths:
  • /trunk/extensions/UsabilityInitiative/ClickTracking/ApiSpecialClickTracking.php (modified) (history)
  • /trunk/extensions/UsabilityInitiative/ClickTracking/SpecialClickTracking.php (modified) (history)

Diff [purge]

Index: trunk/extensions/UsabilityInitiative/ClickTracking/SpecialClickTracking.php
@@ -487,6 +487,16 @@
488488
489489 }
490490
 491+ /**
 492+ * Space out the dates for date validation
 493+ * @param $datewithnospaces date with no spaces
 494+ * @return date with spaces
 495+ */
 496+ public static function space_out_date( $datewithnospaces ) {
 497+ return ( substr( $datewithnospaces, 0, 4 ) . ' ' .substr( $datewithnospaces, 4, 2 ) . ' ' . substr( $datewithnospaces, 6, 2 ) );
 498+ }
 499+
 500+
491501 /*
492502 * get time constraints
493503 * @param minTime minimum day (YYYYMMDD)
@@ -494,9 +504,13 @@
495505 * NOTE: once some of the constraints have been finalized, this will use more of the Database functions and not raw SQL
496506 */
497507 static function getTimeConstraintsStatement( $minTime, $maxTime ){
498 - if($minTime == 0 || $maxTime == 0){
499 - return '';
500 - }
 508+ $minTime = addslashes($minTime);
 509+ $maxTime = addslashes($maxTime);
 510+ if( $minTime == 0 || $maxTime == 0 ||
 511+ ( strptime( SpecialClickTracking::space_out_date( $minTime ), "%Y %m %d" ) === false ) ||
 512+ ( strptime( SpecialClickTracking::space_out_date( $minTime ), "%Y %m %d" ) === false ) ) {
 513+ return '';
 514+ }
501515 else {
502516
503517 return "WHERE `action_time` >= '$minTime' AND `action_time` <= '$maxTime'";
@@ -514,17 +528,10 @@
515529 */
516530 public static function getTopEvents($minTime = "", $maxTime = "", $normalize_top_results = false){
517531
518 - $normalize = "click_tracking";
519 - //escaped
520 -
521532 $time_constraint_statement = self::getTimeConstraintsStatement($minTime,$maxTime);
522533 $time_constraint = $time_constraint_statement;
523534
524 - if($normalize_top_results){
525 - $normalize = "(select distinct session_id, event_id from click_tracking $time_constraint_statement) as t1";
526 - $time_constraint = "";
527 - }
528 - $sql = "select count(event_id) as totalevtid, event_id,event_name from $normalize" .
 535+ $sql = "select count(event_id) as totalevtid, event_id,event_name from click_tracking" .
529536 " LEFT JOIN click_tracking_events ON event_id=click_tracking_events.id".
530537 " $time_constraint group by event_id order by totalevtid desc";
531538
@@ -541,14 +548,8 @@
542549 */
543550 static function getTableValue($event_id, $userDef, $minTime = '', $maxTime = '', $normalize_results = false){
544551
545 - $normalize = "click_tracking";
546 - //escaped
547552 $time_constraint_statement = self::getTimeConstraintsStatement($minTime,$maxTime);
548553 $time_constraint = $time_constraint_statement;
549 - if($normalize_results){
550 - $normalize = "(select distinct session_id, event_id, user_total_contribs, user_contribs_span1, user_contribs_span2, user_contribs_span3, is_logged_in from click_tracking $time_constraint_statement) as t1";
551 - $time_constraint = "";
552 - }
553554
554555 $user_conditions = SpecialClickTracking::buildUserDefQuery($userDef);
555556
@@ -556,7 +557,7 @@
557558
558559 $and = ($time_constraint == "" ? "": "and");
559560
560 - $sql ="select count(*) as totalcount from $normalize $where $time_constraint $and ($user_conditions) and event_id=$event_id";
 561+ $sql ="select count(*) as totalcount from click_tracking $where $time_constraint $and ($user_conditions) and event_id=$event_id";
561562
562563 $dbr = wfGetDB( DB_SLAVE );
563564 $result = $dbr->query($sql);
Index: trunk/extensions/UsabilityInitiative/ClickTracking/ApiSpecialClickTracking.php
@@ -55,10 +55,10 @@
5656 }
5757
5858 // check start and end date are of proper format
59 - if( $params['startdate'] != 0 && strptime( $this->space_out_date( $params['startdate'] ), "%Y %m %d" ) === false ) {
 59+ if( $params['startdate'] != 0 && strptime( SpecialClickTracking::space_out_date( $params['startdate'] ), "%Y %m %d" ) === false ) {
6060 $this->dieUsage( "startdate not in YYYYMMDD format: <<{$params['startdate']}>>", 'badstartdate' );
6161 }
62 - if( $params['enddate'] != 0 && strptime( $this->space_out_date( $params['enddate'] ), "%Y %m %d" ) === false ) {
 62+ if( $params['enddate'] != 0 && strptime( SpecialClickTracking::space_out_date( $params['enddate'] ), "%Y %m %d" ) === false ) {
6363 $this->dieUsage( "enddate not in YYYYMMDD format:<<{$params['enddate']}>>", 'badenddate' );
6464 }
6565
@@ -72,15 +72,8 @@
7373 }
7474 }
7575
76 - /**
77 - * Space out the dates
78 - * @param $datewithnospaces date with no spaces
79 - * @return date with spaces
80 - */
81 - public function space_out_date( $datewithnospaces ) {
82 - return ( substr( $datewithnospaces, 0, 4 ) . ' ' .substr( $datewithnospaces, 4, 2 ) . ' ' . substr( $datewithnospaces, 6, 2 ) );
83 - }
8476
 77+
8578 public function getParamDescription() {
8679 return array(
8780 'eventid' => 'event ID (number)',

Status & tagging log