/** * Does $column actually exist on $table? * * Guards the update_texts / update_cat_info handlers in ajax/ajax_admin.php, which build their * SET clause from the POSTed field name: the VALUE goes through zen_db_input(), the COLUMN NAME * did not, and there was no check that it named a real column. The endpoint is behind * validate_admin(), so this is hardening rather than a public hole -- but it is also why a * malformed field reached the database unchallenged instead of being rejected. * * Checked against the live schema rather than a hand-maintained allow-list on purpose: a list * silently stops saving any field somebody forgets to add to it, and that form carries around * thirty. Every legitimate field passes automatically because its column exists. * * @param string $table a TABLE_* constant, never user input * @param string $column the column name derived from the POST key * @return bool */ function zen_table_has_column($table, $column) { global $db, $function_cache; $table = (string)$table; $column = (string)$column; if ($table == '' || $column == '') { return false; } if (!isset($function_cache['zen_table_has_column'][$table])) { $columns = array(); $result = $db->Execute("SHOW COLUMNS FROM " . $table); while (!$result->EOF) { $columns[] = $result->fields['Field']; $result->MoveNext(); } $function_cache['zen_table_has_column'][$table] = $columns; } $columns = $function_cache['zen_table_has_column'][$table]; if (empty($columns)) { // Schema unreadable. Fail OPEN and log: blocking every admin save because of a // transient DB hiccup is a worse outcome than the pre-existing behaviour, and the // endpoint is admin-only either way. e_log('zen_table_has_column: could not read columns for ' . $table); return true; } return in_array($column, $columns, true); } Sifferballong - Blå - 35 cm - 29 kr - Sifferballonger - MyPerfectDay.se
Fri frakt över 599 kr
Över 290 000 nöjda kunder
14 dagars öppet köp
Nyheter >>
Kampanj >>
Meny
Sök
filter-horizontal Filter
Favoriter
Fler än 25 st i lager - Leveranstid: 2-3 vardagar
0
Fri frakt över 599 kr
0