fernando/luos
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix to the bug related to sql queries inside form fields with sigle quotes

Browse Source
This commit is contained in:
gustavo
2011-03-17 15:46:03 -04:00
committed by Alexandre Rosenfeld
parent ea31c50178
commit 9697b28051
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
workflow/engine/methods/dynaforms/fields_Save.php Normal file → Executable file
View File

@@ -74,6 +74,9 @@ if (($RBAC_Response=$RBAC->userCanAccess("PM_FACTORY"))!=1) return $RBAC_Respons
define('DB_XMLDB_NAME',''); define('DB_XMLDB_NAME','');
define('DB_XMLDB_TYPE','myxml'); define('DB_XMLDB_TYPE','myxml');
if (isset($_POST['form']['PME_XMLNODE_VALUE'])){
$_POST['form']['PME_XMLNODE_VALUE'] = str_replace("'", "\"" , $_POST['form']['PME_XMLNODE_VALUE']);
}
if (file_exists( PATH_XMLFORM . 'dynaforms/fields/' . $type . '.xml')) { if (file_exists( PATH_XMLFORM . 'dynaforms/fields/' . $type . '.xml')) {
$form=new Form('dynaforms/fields/' . $type , PATH_XMLFORM); $form=new Form('dynaforms/fields/' . $type , PATH_XMLFORM);
@@ -201,4 +204,4 @@ if (($RBAC_Response=$RBAC->userCanAccess("PM_FACTORY"))!=1) return $RBAC_Respons
global $_DBArray; global $_DBArray;
$_DBArray['fields'] = $aFields; $_DBArray['fields'] = $aFields;
$_SESSION['_DBArray'] = $_DBArray; $_SESSION['_DBArray'] = $_DBArray;
?> ?>