diff --git a/docs/changelog/6.x.x.txt b/docs/changelog/6.x.x.txt index 4d0b46244..1ae48dc4f 100644 --- a/docs/changelog/6.x.x.txt +++ b/docs/changelog/6.x.x.txt @@ -39,6 +39,8 @@ - Bugfix: [ 995088 ] Error in printable macro 6.1.1 - Bugfix: [ 1003511 ] Users cannot be added to Registered Users if removed - Bugfix: [ 996592 ] Fixed Infinite loop in Page.pm makeUnique in 6.1.1 + - Converted all IDs to use global unique ids rather than incremented ids as + they were in the past. 6.1.1 diff --git a/lib/WebGUI/Wobject.pm b/lib/WebGUI/Wobject.pm index 866372642..4c0c872fe 100644 --- a/lib/WebGUI/Wobject.pm +++ b/lib/WebGUI/Wobject.pm @@ -523,14 +523,11 @@ sub moveCollateralDown { unless (defined $setValue) { $setValue = $_[0]->get($setName); } - ($seq) = WebGUI::SQL->quickArray("select sequenceNumber from $_[1] where $_[2]=$_[3] and $setName=".quote($setValue)); - ($id) = WebGUI::SQL->quickArray("select $_[2] from $_[1] where $setName=".quote($setValue) - ." and sequenceNumber=$seq+1"); + ($seq) = WebGUI::SQL->quickArray("select sequenceNumber from $_[1] where $_[2]=".quote($_[3])." and $setName=".quote($setValue)); + ($id) = WebGUI::SQL->quickArray("select $_[2] from $_[1] where $setName=".quote($setValue)." and sequenceNumber=$seq+1"); if ($id ne "") { - WebGUI::SQL->write("update $_[1] set sequenceNumber=sequenceNumber+1 where $_[2]=".quote($_[3])." and $setName=" - .quote($setValue)); - WebGUI::SQL->write("update $_[1] set sequenceNumber=sequenceNumber-1 where $_[2]=".quote($id)." and $setName=" - .quote($setValue)); + WebGUI::SQL->write("update $_[1] set sequenceNumber=sequenceNumber+1 where $_[2]=".quote($_[3])." and $setName=" .quote($setValue)); + WebGUI::SQL->write("update $_[1] set sequenceNumber=sequenceNumber-1 where $_[2]=".quote($id)." and $setName=" .quote($setValue)); } } diff --git a/lib/WebGUI/Wobject/DataForm.pm b/lib/WebGUI/Wobject/DataForm.pm index 309c42b17..96766ba96 100644 --- a/lib/WebGUI/Wobject/DataForm.pm +++ b/lib/WebGUI/Wobject/DataForm.pm @@ -109,7 +109,7 @@ sub _tabAdminIcons { #------------------------------------------------------------------- sub _createTabInit { my $wid = $_[0]; - my @tabCount = WebGUI::SQL->quickArray("select count(DataForm_tabId) from DataForm_tab where wobjectId=$wid"); + my @tabCount = WebGUI::SQL->quickArray("select count(DataForm_tabId) from DataForm_tab where wobjectId=".quote($wid)); my $output = ''; return $output; } @@ -120,7 +120,7 @@ sub duplicate { tie %data, 'Tie::CPHash'; $w = $_[0]->SUPER::duplicate($_[1]); $w = WebGUI::Wobject::DataForm->new({wobjectId=>$w,namespace=>$_[0]->get("namespace")}); - $sth = WebGUI::SQL->read("select * from DataForm_field where wobjectId=".$_[0]->get("wobjectId")); + $sth = WebGUI::SQL->read("select * from DataForm_field where wobjectId=".quote($_[0]->get("wobjectId"))); while (%data = $sth->hash) { $data{DataForm_fieldId} = "new"; $w->setCollateral("DataForm_field","DataForm_fieldId",\%data); @@ -157,8 +157,8 @@ sub getIndexerParams { fieldsToIndex => ["label", "subtext", "possibleValues"], contentType => 'wobjectDetail', url => '$data{urlizedTitle}."#".$data{wid}', - headerShortcut => 'select label from DataForm_field where DataForm_fieldId = $data{fid}', - bodyShortcut => 'select subtext from DataForm_field where DataForm_fieldId = $data{fid}', + headerShortcut => 'select label from DataForm_field where DataForm_fieldId = \'$data{fid}\'', + bodyShortcut => 'select subtext from DataForm_field where DataForm_fieldId = \'$data{fid}\'', }, DataForm_entryData => { sql => "select distinct(DataForm_entryData.wobjectId) as wid, @@ -177,10 +177,10 @@ sub getIndexerParams { and wobject.endDate > $now and page.startDate < $now and page.endDate > $now", - fieldsToIndex => ['select distinct(value) from DataForm_entryData where wobjectId = $data{wid}'], + fieldsToIndex => ['select distinct(value) from DataForm_entryData where wobjectId = \'$data{wid}\''], contentType => 'wobjectDetail', url => 'WebGUI::URL::append($data{urlizedTitle}, "func=view&entryId=list&wid=$data{wid}")', - headerShortcut => 'select title from wobject where wobjectId = $data{wid}', + headerShortcut => 'select title from wobject where wobjectId = \'$data{wid}\'', } }; } @@ -194,7 +194,7 @@ sub getListTemplateVars { $var->{"back.url"} = WebGUI::URL::page(); $var->{"back.label"} = WebGUI::International::get(18,$self->get("namespace")); my $a = WebGUI::SQL->read("select DataForm_fieldId,name,label,isMailField,type from DataForm_field - where wobjectId=".$self->get("wobjectId")." order by sequenceNumber"); + where wobjectId=".quote($self->get("wobjectId"))." order by sequenceNumber"); while (my $field = $a->hashRef) { push(@fieldLoop,{ "field.name"=>$field->{name}, @@ -208,11 +208,11 @@ sub getListTemplateVars { $var->{field_loop} = \@fieldLoop; my @recordLoop; my $a = WebGUI::SQL->read("select ipAddress,username,userid,submissionDate,DataForm_entryId from DataForm_entry - where wobjectId=".$self->get("wobjectId")." order by submissionDate desc"); + where wobjectId=".quote($self->get("wobjectId"))." order by submissionDate desc"); while (my $record = $a->hashRef) { my @dataLoop; my $b = WebGUI::SQL->read("select b.name, b.label, b.isMailField, a.value from DataForm_entryData a left join DataForm_field b - on a.DataForm_fieldId=b.DataForm_fieldId where a.DataForm_entryId=".$record->{DataForm_entryId}." + on a.DataForm_fieldId=b.DataForm_fieldId where a.DataForm_entryId=".quote($record->{DataForm_entryId})." order by b.sequenceNumber"); while (my $data = $b->hashRef) { push(@dataLoop,{ @@ -265,7 +265,7 @@ sub getRecordTemplateVars { my @tabs; my $select = "select a.name, a.DataForm_fieldId, a.DataForm_tabId,a.label, a.status, a.isMailField, a.subtext, a.type, a.defaultValue, a.possibleValues, a.width, a.rows, a.extras, a.vertical"; my $join; - my $where = "where a.wobjectId=".$self->get("wobjectId"); + my $where = "where a.wobjectId=".quote($self->get("wobjectId")); if ($var->{entryId}) { $var->{"form.start"} .= WebGUI::Form::hidden({name=>"entryId",value=>$var->{entryId}}); my $entry = $self->getCollateral("DataForm_entry","DataForm_entryId",$var->{entryId}); @@ -275,7 +275,7 @@ sub getRecordTemplateVars { $var->{date} = WebGUI::DateTime::epochToHuman($entry->{submissionDate}); $var->{epoch} = $entry->{submissionDate}; $var->{"edit.URL"} = WebGUI::URL::page('func=view&wid='.$self->get("wobjectId").'&entryId='.$var->{entryId}); - $where .= " and b.DataForm_entryId=".$var->{entryId}; + $where .= " and b.DataForm_entryId=".quote($var->{entryId}); $join = "left join DataForm_entryData as b on a.DataForm_fieldId=b.DataForm_fieldId"; $select .= ", b.value"; } @@ -283,10 +283,10 @@ sub getRecordTemplateVars { tie %data, 'Tie::CPHash'; my %tab; tie %tab, 'Tie::CPHash'; - my $tabsth = WebGUI::SQL->read("select * from DataForm_tab where wobjectId=".$self->get("wobjectId")." order by sequenceNumber"); + my $tabsth = WebGUI::SQL->read("select * from DataForm_tab where wobjectId=".quote($self->get("wobjectId"))." order by sequenceNumber"); while (%tab = $tabsth->hash) { my @fields; - my $sth = WebGUI::SQL->read("$select from DataForm_field as a $join $where and a.DataForm_tabId=".$tab{DataForm_tabId}." order by a.sequenceNumber"); + my $sth = WebGUI::SQL->read("$select from DataForm_field as a $join $where and a.DataForm_tabId=".quote($tab{DataForm_tabId})." order by a.sequenceNumber"); while (%data = $sth->hash) { my $formValue = $session{form}{$data{name}}; if ((not exists $data{value}) && $session{form}{func} ne "editSave" && $session{form}{func} ne "editFieldSave" && defined $formValue) { @@ -405,10 +405,10 @@ sub new { #------------------------------------------------------------------- sub purge { - WebGUI::SQL->write("delete from DataForm_field where wobjectId=".$_[0]->get("wobjectId")); - WebGUI::SQL->write("delete from DataForm_entry where wobjectId=".$_[0]->get("wobjectId")); - WebGUI::SQL->write("delete from DataForm_entryData where wobjectId=".$_[0]->get("wobjectId")); - WebGUI::SQL->write("delete from DataForm_tab where wobjectId=".$_[0]->get("wobjectId")); + WebGUI::SQL->write("delete from DataForm_field where wobjectId=".quote($_[0]->get("wobjectId"))); + WebGUI::SQL->write("delete from DataForm_entry where wobjectId=".quote($_[0]->get("wobjectId"))); + WebGUI::SQL->write("delete from DataForm_entryData where wobjectId=".quote($_[0]->get("wobjectId"))); + WebGUI::SQL->write("delete from DataForm_tab where wobjectId=".quote($_[0]->get("wobjectId"))); $_[0]->SUPER::purge(); } @@ -625,9 +625,9 @@ sub www_editField { ); $session{form}{fid} = "new" if ($session{form}{fid} eq ""); unless ($session{form}{fid} eq "new") { - %field = WebGUI::SQL->quickHash("select * from DataForm_field where DataForm_fieldId=$session{form}{fid}"); + %field = WebGUI::SQL->quickHash("select * from DataForm_field where DataForm_fieldId=".quote($session{form}{fid})); } - $tab = WebGUI::SQL->buildHashRef("select DataForm_tabId,label from DataForm_tab where wobjectId=".$_[0]->get("wobjectId")); + $tab = WebGUI::SQL->buildHashRef("select DataForm_tabId,label from DataForm_tab where wobjectId=".quote($_[0]->get("wobjectId"))); $output = helpIcon("data form fields add/edit",$_[0]->get("namespace")); $output .= '