Changeset 146 for trunk/lib/Lock.inc.php

Timestamp:

Jun 5, 2006 1:14:51 AM (18 years ago)

Author:

scdev

Message:

Q - added persistant database storage to Prefs.inc.php. Modified getParam failure log type to LOG_DEBUG in all classes.

File:

• trunk/lib/Lock.inc.php (modified) (11 diffs)

trunk/lib/Lock.inc.php

@@ -17 +17 @@
         'error_url' => '/lock.php',
         'db_table' => 'lock_tbl',
-        'create_table' => true, // Automatically create table and verify columns. Better set to false after site launch.
+
+        // Automatically create table and verify columns. Better set to false after site launch.
+        'create_table' => true,
     );
 
@@ -84 +86 @@
                 $app->logMsg(sprintf('Dropping and recreating table %s.', $this->getParam('db_table')), LOG_DEBUG, __FILE__, __LINE__);
             }
-            $db->query("CREATE TABLE IF NOT EXISTS " . $this->getParam('db_table') . " (
+            $db->query("CREATE TABLE IF NOT EXISTS " . $db->escapeString($this->getParam('db_table')) . " (
                 lock_id int NOT NULL auto_increment,
                 record_table varchar(255) NOT NULL default '',
@@ -141 +143 @@
             return $this->_params[$param];
         } else {
-            $app->logMsg(sprintf('Parameter is not set: %s', $param), LOG_NOTICE, __FILE__, __LINE__);
+            $app->logMsg(sprintf('Parameter is not set: %s', $param), LOG_DEBUG, __FILE__, __LINE__);
             return null;
         }
@@ -168 +170 @@
             // Get lock data by lock_id.
             $qid = $db->query("
-                SELECT * FROM " . $this->getParam('db_table') . "
+                SELECT * FROM " . $db->escapeString($this->getParam('db_table')) . "
                 WHERE lock_id = '" . $db->escapeString($record_table_or_lock_id) . "'
             ");
@@ -174 +176 @@
             // Get lock data by record specs
             $qid = $db->query("
-                SELECT * FROM " . $this->getParam('db_table') . "
+                SELECT * FROM " . $db->escapeString($this->getParam('db_table')) . "
                 WHERE record_table = '" . $db->escapeString($record_table_or_lock_id) . "'
                 AND record_key = '" . $db->escapeString($record_key) . "'
@@ -214 +216 @@
 
         if (isset($this->data['lock_id'])) {
-            $qid = $db->query("SELECT * FROM " . $this->getParam('db_table') . " WHERE lock_id = '" . $db->escapeString($this->data['lock_id']) . "'");
+            $qid = $db->query("SELECT * FROM " . $db->escapeString($this->getParam('db_table')) . " WHERE lock_id = '" . $db->escapeString($this->data['lock_id']) . "'");
             if ($lock = mysql_fetch_assoc($qid)) {
                 return ($lock['set_by_admin_id'] == $this->_auth->getVal('user_id'));
@@ -246 +248 @@
         // Remove previous locks if exist. Is this better than using a REPLACE INTO?
         $db->query("
-            DELETE FROM " . $this->getParam('db_table') . "
+            DELETE FROM " . $db->escapeString($this->getParam('db_table')) . "
             WHERE record_table = '" . $db->escapeString($record_table) . "'
             AND record_key = '" . $db->escapeString($record_key) . "'
@@ -254 +256 @@
         // Set new lock.
         $db->query("
-            INSERT INTO " . $this->getParam('db_table') . " (
+            INSERT INTO " . $db->escapeString($this->getParam('db_table')) . " (
                 record_table,
                 record_key,
@@ -293 +295 @@
         // Delete a specific lock.
         $db->query("
-            DELETE FROM " . $this->getParam('db_table') . "
+            DELETE FROM " . $db->escapeString($this->getParam('db_table')) . "
             WHERE lock_id = '" . $db->escapeString($this->data['lock_id']) . "'
         ");
@@ -315 +317 @@
         if (isset($user_id)) {
             // Delete specific user's locks.
-            $db->query("DELETE FROM " . $this->getParam('db_table') . " WHERE set_by_admin_id = '" . $db->escapeString($user_id) . "'");
+            $db->query("DELETE FROM " . $db->escapeString($this->getParam('db_table')) . " WHERE set_by_admin_id = '" . $db->escapeString($user_id) . "'");
             $app->logMsg(sprintf('Record locks owned by %s %s have been deleted', $this->_auth->getVal('auth_name'), $this->_auth->getUsername($user_id)), LOG_DEBUG, __FILE__, __LINE__);
         } else {
             // Delete ALL locks.
-            $db->query("DELETE FROM " . $this->getParam('db_table') . "");
+            $db->query("DELETE FROM " . $db->escapeString($this->getParam('db_table')) . "");
             $app->logMsg(sprintf('All record locks deleted by %s %s', $this->_auth->getVal('auth_name'), $this->_auth->getVal('username')), LOG_DEBUG, __FILE__, __LINE__);
         }
@@ -338 +340 @@
             // Delete all old locks.
             $db->query("
-                DELETE FROM " . $this->getParam('db_table') . "
+                DELETE FROM " . $db->escapeString($this->getParam('db_table')) . "
                 WHERE DATE_ADD(lock_datetime, INTERVAL '" . $this->getParam('auto_timeout') . "' SECOND) < NOW()
             ");