Skip to content

Commit 2118f6f

Browse files
somethingwithproofsomethingwithproof
committed
fix: convert remaining db_execute to prepared statements in notify_lists.php
Convert all template and thold_data association/disassociation queries from raw string concatenation with $selected_items[$i] to db_execute_prepared with bound parameters. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
1 parent 8b298b7 commit 2118f6f

1 file changed

Lines changed: 17 additions & 54 deletions

File tree

‎notify_lists.php‎

Lines changed: 17 additions & 54 deletions
Original file line numberDiff line numberDiff line change
@@ -394,42 +394,29 @@ function form_actions() {
394394
// clear other settings
395395
if (get_request_var('notification_warning_action') == 1) {
396396
// set the notification list
397-
db_execute('UPDATE thold_template
398-
SET notify_warning=' . get_request_var('id') . '
399-
WHERE id=' . $selected_items[$i]);
397+
db_execute_prepared('UPDATE thold_template SET notify_warning=? WHERE id=?', [intval(get_request_var('id')), intval($selected_items[$i])]);
400398

401399
// clear other items
402-
db_execute("UPDATE thold_template
403-
SET notify_warning_extra=''
404-
WHERE id=" . $selected_items[$i]);
400+
db_execute_prepared("UPDATE thold_template SET notify_warning_extra='' WHERE id=?", [intval($selected_items[$i])]);
405401
} else {
406402
// set the notification list
407-
db_execute('UPDATE thold_template
408-
SET notify_warning=' . get_request_var('id') . '
409-
WHERE id=' . $selected_items[$i]);
403+
db_execute_prepared('UPDATE thold_template SET notify_warning=? WHERE id=?', [intval(get_request_var('id')), intval($selected_items[$i])]);
410404
}
411405
}
412406

413407
if (get_request_var('notification_alert_action') > 0) {
414408
// clear other settings
415409
if (get_request_var('notification_alert_action') == 1) {
416410
// set the notification list
417-
db_execute('UPDATE thold_template
418-
SET notify_alert=' . get_request_var('id') . '
419-
WHERE id=' . $selected_items[$i]);
411+
db_execute_prepared('UPDATE thold_template SET notify_alert=? WHERE id=?', [intval(get_request_var('id')), intval($selected_items[$i])]);
420412

421413
// clear other items
422-
db_execute("UPDATE thold_template
423-
SET notify_extra=''
424-
WHERE id=" . $selected_items[$i]);
414+
db_execute_prepared("UPDATE thold_template SET notify_extra='' WHERE id=?", [intval($selected_items[$i])]);
425415

426-
db_execute('DELETE FROM plugin_thold_template_contact
427-
WHERE template_id=' . $selected_items[$i]);
416+
db_execute_prepared('DELETE FROM plugin_thold_template_contact WHERE template_id=?', [intval($selected_items[$i])]);
428417
} else {
429418
// set the notification list
430-
db_execute('UPDATE thold_template
431-
SET notify_alert=' . get_request_var('id') . '
432-
WHERE id=' . $selected_items[$i]);
419+
db_execute_prepared('UPDATE thold_template SET notify_alert=? WHERE id=?', [intval(get_request_var('id')), intval($selected_items[$i])]);
433420
}
434421
}
435422

@@ -439,18 +426,12 @@ function form_actions() {
439426
for ($i = 0; ($i < count($selected_items)); $i++) {
440427
if (get_request_var('notification_warning_action') > 0) {
441428
// set the notification list
442-
db_execute('UPDATE thold_template
443-
SET notify_warning=0
444-
WHERE id=' . $selected_items[$i] . '
445-
AND notify_warning=' . get_request_var('id'));
429+
db_execute_prepared('UPDATE thold_template SET notify_warning=0 WHERE id=? AND notify_warning=?', [intval($selected_items[$i]), intval(get_request_var('id'))]);
446430
}
447431

448432
if (get_request_var('notification_alert_action') > 0) {
449433
// set the notification list
450-
db_execute('UPDATE thold_template
451-
SET notify_alert=0
452-
WHERE id=' . $selected_items[$i] . '
453-
AND notify_alert=' . get_request_var('id'));
434+
db_execute_prepared('UPDATE thold_template SET notify_alert=0 WHERE id=? AND notify_alert=?', [intval($selected_items[$i]), intval(get_request_var('id'))]);
454435
}
455436

456437
thold_template_update_thresholds($selected_items[$i]);
@@ -472,60 +453,42 @@ function form_actions() {
472453
// clear other settings
473454
if (get_request_var('notification_warning_action') == 1) {
474455
// set the notification list
475-
db_execute('UPDATE thold_data
476-
SET notify_warning=' . get_request_var('id') . '
477-
WHERE id=' . $selected_items[$i]);
456+
db_execute_prepared('UPDATE thold_data SET notify_warning=? WHERE id=?', [intval(get_request_var('id')), intval($selected_items[$i])]);
478457

479458
// clear other items
480-
db_execute("UPDATE thold_data
481-
SET notify_warning_extra=''
482-
WHERE id=" . $selected_items[$i]);
459+
db_execute_prepared("UPDATE thold_data SET notify_warning_extra='' WHERE id=?", [intval($selected_items[$i])]);
483460
} else {
484461
// set the notification list
485-
db_execute('UPDATE thold_data
486-
SET notify_warning=' . get_request_var('id') . '
487-
WHERE id=' . $selected_items[$i]);
462+
db_execute_prepared('UPDATE thold_data SET notify_warning=? WHERE id=?', [intval(get_request_var('id')), intval($selected_items[$i])]);
488463
}
489464
}
490465

491466
if (get_request_var('notification_alert_action') > 0) {
492467
// clear other settings
493468
if (get_request_var('notification_alert_action') == 1) {
494469
// set the notification list
495-
db_execute('UPDATE thold_data
496-
SET notify_alert=' . get_request_var('id') . '
497-
WHERE id=' . $selected_items[$i]);
470+
db_execute_prepared('UPDATE thold_data SET notify_alert=? WHERE id=?', [intval(get_request_var('id')), intval($selected_items[$i])]);
498471

499472
// clear other items
500-
db_execute("UPDATE thold_data
501-
SET notify_extra=''
502-
WHERE id=" . $selected_items[$i]);
473+
db_execute_prepared("UPDATE thold_data SET notify_extra='' WHERE id=?", [intval($selected_items[$i])]);
503474

504475
db_execute_prepared('DELETE FROM plugin_thold_threshold_contact WHERE thold_id = ?', [intval($selected_items[$i])]);
505476
} else {
506477
// set the notification list
507-
db_execute('UPDATE thold_data
508-
SET notify_alert=' . get_request_var('id') . '
509-
WHERE id=' . $selected_items[$i]);
478+
db_execute_prepared('UPDATE thold_data SET notify_alert=? WHERE id=?', [intval(get_request_var('id')), intval($selected_items[$i])]);
510479
}
511480
}
512481
}
513482
} elseif (get_request_var('drp_action') == '2') { // disassociate
514483
for ($i = 0; ($i < count($selected_items)); $i++) {
515484
if (get_request_var('notification_warning_action') > 0) {
516485
// set the notification list
517-
db_execute('UPDATE thold_data
518-
SET notify_warning=0
519-
WHERE id=' . $selected_items[$i] . '
520-
AND notify_warning=' . get_request_var('id'));
486+
db_execute_prepared('UPDATE thold_data SET notify_warning=0 WHERE id=? AND notify_warning=?', [intval($selected_items[$i]), intval(get_request_var('id'))]);
521487
}
522488

523489
if (get_request_var('notification_alert_action') > 0) {
524490
// set the notification list
525-
db_execute('UPDATE thold_data
526-
SET notify_alert=0
527-
WHERE id=' . $selected_items[$i] . '
528-
AND notify_alert=' . get_request_var('id'));
491+
db_execute_prepared('UPDATE thold_data SET notify_alert=0 WHERE id=? AND notify_alert=?', [intval($selected_items[$i]), intval(get_request_var('id'))]);
529492
}
530493
}
531494
}

0 commit comments

Comments
 (0)