mirror/php-e107
1
0
Fork 0
mirror of https://github.com/e107inc/e107.git synced 2025-08-15 11:04:18 +02:00
Code Issues Releases Wiki Activity

Issue #3657 Add update limits on user_class changes throughout.

Browse Source
This commit is contained in:
Cameron
2019-02-22 11:10:05 -08:00
parent 2c17c4ff9c
commit 9e6c2a79f0
4 changed files with 12 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
e107_handlers/userclass_class.php
View File

@@ -1814,13 +1814,13 @@ class user_class_admin extends user_class
{
if (self::delete_class($classID) === TRUE)
{
if ($this->sql_r->db_Select('user', 'user_id, user_class', "user_class REGEXP '(^|,){$classID}(,|$)'"))
if ($this->sql_r->select('user', 'user_id, user_class', "user_class REGEXP '(^|,){$classID}(,|$)'"))
{
$sql2 = e107::getDb('sql2');
while ($row = $this->sql_r->db_Fetch())
while ($row = $this->sql_r->fetch())
{
$newClass = self::ucRemove($classID, $row['user_class']);
$sql2->db_Update('user', "user_class = '{$newClass}' WHERE user_id = {$row['user_id']}");
$sql2->update('user', "user_class = '{$newClass}' WHERE user_id = {$row['user_id']} LIMIT 1");
}
}
return TRUE;
@@ -1852,7 +1852,7 @@ class user_class_admin extends user_class
{
$new_userclass = $cid;
}
$uc_sql->db_Update('user', "user_class='".e107::getParser()->toDB($new_userclass, true)."' WHERE user_id=".intval($uid));
$uc_sql->update('user', "user_class='".e107::getParser()->toDB($new_userclass, true)."' WHERE user_id=".intval($uid)." LIMIT 1");
}
}
@@ -1867,13 +1867,12 @@ class user_class_admin extends user_class
*/
public function class_remove($cid, $uinfoArray)
{
$e107 = e107::getInstance();
$uc_sql = new db;
$uc_sql = e107::getDb();
foreach($uinfoArray as $uid => $curclass)
{
$newarray = array_diff(explode(',', $curclass), array('', $cid));
$new_userclass = implode(',', $newarray);
$uc_sql->update('user', "user_class='".e107::getParser()->toDB($new_userclass, true)."' WHERE user_id=".intval($uid));
$uc_sql->update('user', "user_class='".e107::getParser()->toDB($new_userclass, true)."' WHERE user_id=".intval($uid)." LIMIT 1");
}
}