mirror of
https://github.com/silverstripe/silverstripe-reports
synced 2024-09-08 02:31:24 +02:00
BUGFIX Consistently using Convert::raw2sql() instead of DB::getConn()->addslashes() or PHP's deprecated addslashes() for database escaping
This commit is contained in:
parent
5cd1b523ea
commit
b5ea2f68fe
@ -378,7 +378,7 @@ HTML;
|
||||
public function movemarked($urlParams, $form) {
|
||||
if($_REQUEST['DestFolderID'] && (is_numeric($_REQUEST['DestFolderID']) || ($_REQUEST['DestFolderID']) == 'root')) {
|
||||
$destFolderID = ($_REQUEST['DestFolderID'] == 'root') ? 0 : $_REQUEST['DestFolderID'];
|
||||
$fileList = "'" . ereg_replace(' *, *',"','",trim(addslashes($_REQUEST['FileIDs']))) . "'";
|
||||
$fileList = "'" . ereg_replace(' *, *',"','",trim(Convert::raw2sql($_REQUEST['FileIDs']))) . "'";
|
||||
$numFiles = 0;
|
||||
|
||||
if($fileList != "''") {
|
||||
@ -411,7 +411,7 @@ HTML;
|
||||
* Called and returns in same way as 'save' function
|
||||
*/
|
||||
public function deletemarked($urlParams, $form) {
|
||||
$fileList = "'" . ereg_replace(' *, *',"','",trim(addslashes($_REQUEST['FileIDs']))) . "'";
|
||||
$fileList = "'" . ereg_replace(' *, *',"','",trim(Convert::raw2sql($_REQUEST['FileIDs']))) . "'";
|
||||
$numFiles = 0;
|
||||
$folderID = 0;
|
||||
$deleteList = '';
|
||||
|
Loading…
Reference in New Issue
Block a user