GNUsocial/gnu-social
4
0
Fork 1
Code Issues Releases Wiki Activity

sprintf for SQL calls, please

Browse Source
This commit is contained in:
Mikael Nordfeldth 2014-05-19 01:09:21 +02:00
parent d7c40e77b2
commit f37fc4247a
1 changed files with 3 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
plugins/Autocomplete/actions/autocomplete.php
View File

@ -96,12 +96,6 @@ class AutocompleteAction extends Action
parent::prepare($args); parent::prepare($args);
$cur = common_current_user();
if (!$cur) {
// TRANS: Client exception in autocomplete plugin.
throw new ClientException(_m('Access forbidden.'), true);
}
$this->groups=array(); $this->groups=array();
$this->profiles=array(); $this->profiles=array();
$term = $this->arg('term'); $term = $this->arg('term');
@ -115,7 +109,7 @@ class AutocompleteAction extends Action
$profile->whereAdd('nickname like \'' . trim($profile->escape($term), '\'') . '%\''); $profile->whereAdd('nickname like \'' . trim($profile->escape($term), '\'') . '%\'');
$profile->whereAdd(sprintf('id in (SELECT id FROM user) OR ' $profile->whereAdd(sprintf('id in (SELECT id FROM user) OR '
. 'id in (SELECT subscribed from subscription' . 'id in (SELECT subscribed from subscription'
. ' where subscriber = %d)', $cur->id)); . ' where subscriber = %d)', $this->scoped->id));
if ($profile->find()) { if ($profile->find()) {
while($profile->fetch()) { while($profile->fetch()) {
$this->profiles[]=clone($profile); $this->profiles[]=clone($profile);
@ -129,8 +123,8 @@ class AutocompleteAction extends Action
$group->limit($limit); $group->limit($limit);
$group->whereAdd('nickname like \'' . trim($group->escape($term), '\'') . '%\''); $group->whereAdd('nickname like \'' . trim($group->escape($term), '\'') . '%\'');
//Can't post to groups we're not subscribed to...: //Can't post to groups we're not subscribed to...:
$group->whereAdd('id in (SELECT group_id from group_member' $group->whereAdd(sprintf('id in (SELECT group_id FROM group_member'
. ' where profile_id = ' . $cur->id . ')'); . ' WHERE profile_id = %d)', $this->scoped->id));
if($group->find()){ if($group->find()){
while($group->fetch()) { while($group->fetch()) {
$this->groups[]=clone($group); $this->groups[]=clone($group);