mirror/php-phpbb
1
0
Fork 0
mirror of https://github.com/phpbb/phpbb.git synced 2025-07-31 05:50:42 +02:00
Code Issues Releases Wiki Activity

[ticket/14838] Do not query full attachments table in feeds

Browse Source 
The fetch_attachments() will also now throw a runtime exception if a feed
tries to do this nonetheless.

PHPBB3-14838
This commit is contained in:
Marc Alexander
2016-12-25 17:54:11 +01:00
parent bc96a9f1f6
commit 7cad25e4cb
8 changed files with 36 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
phpBB/phpbb/feed/attachments_base.php
View File

@@ -25,8 +25,11 @@ abstract class attachments_base extends \phpbb\feed\base
/**
* Retrieve the list of attachments that may be displayed
*
* @param array $post_ids Specify for which post IDs to fetch the attachments (optional)
* @param array $topic_ids Specify for which topic IDs to fetch the attachments (optional)
*/
protected function fetch_attachments()
protected function fetch_attachments($post_ids = array(), $topic_ids = array())
{
$sql_array = array(
'SELECT' => 'a.*',
@@ -37,7 +40,20 @@ abstract class attachments_base extends \phpbb\feed\base
'ORDER_BY' => 'a.filetime DESC, a.post_msg_id ASC',
);
if (isset($this->topic_id))
if (!empty($post_ids))
{
$sql_array['WHERE'] .= 'AND ' . $this->db->sql_in_set('a.post_msg_id', $post_ids);
}
else if (!empty($topic_ids))
{
if (isset($this->topic_id))
{
$topic_ids[] = $this->topic_id;
}
$sql_array['WHERE'] .= 'AND ' . $this->db->sql_in_set('a.topic_id', $topic_ids);
}
else if (isset($this->topic_id))
{
$sql_array['WHERE'] .= 'AND a.topic_id = ' . (int) $this->topic_id;
}
@@ -51,6 +67,11 @@ abstract class attachments_base extends \phpbb\feed\base
);
$sql_array['WHERE'] .= 'AND t.forum_id = ' . (int) $this->forum_id;
}
else
{
// Do not allow querying the full attachments table
throw new \RuntimeException($this->user->lang('INVALID_FEED_ATTACHMENTS'));
}
$sql = $this->db->sql_build_query('SELECT', $sql_array);
$result = $this->db->sql_query($sql);
@@ -69,7 +90,6 @@ abstract class attachments_base extends \phpbb\feed\base
public function open()
{
parent::open();
$this->fetch_attachments();
}
/**