Index: actions/listpages.php =================================================================== --- actions/listpages.php (revision 812) +++ actions/listpages.php (working copy) @@ -5,6 +5,7 @@ * @version $Id$ * @author Didier Loiseau * @copyright 2005 Didier Loiseau +* @Copyright 2007 Xavier Garreau * @license This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; either version 2 of the License, or @@ -80,7 +81,7 @@ if ($exclude) { // notice we can addslash() the list before splitting it because escaped character are not separators - $exclude = preg_split('/[ ;,\|]/', addslashes($exclude), -1, PREG_SPLIT_NO_EMPTY); + $exclude = preg_split('/[ ;,\|]/', $this->dbObject->escape_string($exclude), -1, PREG_SPLIT_NO_EMPTY); } else { @@ -134,7 +135,7 @@ } // switch if ($sort != 'tag') { - $sql .= ' WHERE a.tag = "' . AddSlashes($tree) . '" AND a.latest = "Y"'; + $sql .= ' WHERE a.tag = "' . $this->dbObject->escape_string($tree) . '" AND a.latest = "Y"'; if (!$rootData = $this->LoadSingle($sql)) { echo '

Erreur ActionListPages: La page ' . htmlentities($tree) . ' n\'existe pas !

'; @@ -152,8 +153,8 @@ // to avoid many loops and computing several time the lists needed for the request, // we store them into variables - $from = '"' . AddSlashes($tree) . '"'; - $exclude[] = AddSlashes($tree); + $from = '"' . $this->dbObject->escape_string($tree) . '"'; + $exclude[] = $this->dbObject->escape_string($tree); $exclude_str = '"' . implode('", "', $exclude) . '"'; for ($i = 1; $i <= $levels; $i++) { @@ -177,7 +178,7 @@ $sql .= ' WHERE from_tag IN (' . $from . ')' . ' AND to_tag NOT IN (' . $from . ')' . ' AND to_tag = a.tag' - . ' AND a.owner = "' . AddSlashes($owner) . '"' + . ' AND a.owner = "' . $this->dbObject->escape_string($owner) . '"' . ' AND a.latest = "Y"'; } else @@ -239,7 +240,7 @@ $newworkingon = array(); foreach ($pages as $page) { - $to_tag = '"' . AddSlashes($page['to_tag']) . '"'; + $to_tag = '"' . $this->dbObject->escape_string($page['to_tag']) . '"'; $workingon[$page['from_tag']][$page['to_tag']] = array('page_exists' => $page['page_exists'], 'haslinksto' => array()); if ($sort != 'tag') { @@ -388,9 +389,9 @@ LEFT JOIN ' . $prefix . 'users ON b.user = name LEFT JOIN ' . $prefix . 'pages user_page ON name = user_page.tag AND user_page.latest = "Y"' . ($owner ? '' : ' LEFT JOIN ' . $prefix . 'pages owner_page ON b.owner = owner_page.tag AND owner_page.latest = "Y"') - . ' WHERE a.user = "' . AddSlashes($user) . '"' + . ' WHERE a.user = "' . $this->dbObject->escape_string($user) . '"' . ' AND a.tag = b.tag AND b.latest = "Y"' - . ($owner ? ' AND b.owner = "' . AddSlashes($owner) . '"' : ''); + . ($owner ? ' AND b.owner = "' . $this->dbObject->escape_string($owner) . '"' : ''); } elseif ($owner) { @@ -406,7 +407,7 @@ { $sql = 'SELECT tag, time FROM ' . $prefix . 'pages a'; } - $sql .= ' WHERE a.owner = "' . AddSlashes($owner) . '" AND a.latest = "Y"'; + $sql .= ' WHERE a.owner = "' . $this->dbObject->escape_string($owner) . '" AND a.latest = "Y"'; } else { Index: actions/resetpassword.php =================================================================== --- actions/resetpassword.php (revision 812) +++ actions/resetpassword.php (working copy) @@ -5,6 +5,7 @@ Copyright 2003 Patrick PAUL Copyright 2003 David DELON Copyright 2004 David VANTYGHEM +Copyright 2007 Xavier GARREAU This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or @@ -28,8 +29,8 @@ { $this->Query("update ".$this->GetConfigValue("table_prefix")."users set ". - "password = md5('".mysql_escape_string($_POST["password"])."') ". - "where name = '".mysql_escape_string($_POST["name"])."' limit 1"); + "password = '".md5($this->dbObject->escape_string($_POST["password"]))."') ". + "where name = '".$this->dbObject->escape_string($_POST["name"])."'"); $this->SetMessage("Mot de passe réinitialisé !"); $this->Redirect($this->href()); Index: actions/usersettings.php =================================================================== --- actions/usersettings.php (revision 812) +++ actions/usersettings.php (working copy) @@ -5,6 +5,7 @@ Copyright 2002, 2003 David DELON Copyright 2002, 2003 Charles NEPOTE Copyright 2002 Patrick PAUL +Copyright 2007 Xavier GARREAU All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions @@ -42,13 +43,13 @@ if ($_REQUEST["action"] == "update") { $this->Query("update ".$this->GetConfigValue("table_prefix")."users set ". - "email = '".mysql_escape_string($_POST["email"])."', ". - "doubleclickedit = '".mysql_escape_string($_POST["doubleclickedit"])."', ". - "show_comments = '".mysql_escape_string($_POST["show_comments"])."', ". - "revisioncount = '".mysql_escape_string($_POST["revisioncount"])."', ". - "changescount = '".mysql_escape_string($_POST["changescount"])."', ". - "motto = '".mysql_escape_string($_POST["motto"])."' ". - "where name = '".$user["name"]."' limit 1"); + "email = '".$this->dbObject->escape_string($_POST["email"])."', ". + "doubleclickedit = '".$this->dbObject->escape_string($_POST["doubleclickedit"])."', ". + "show_comments = '".$this->dbObject->escape_string($_POST["show_comments"])."', ". + "revisioncount = '".$this->dbObject->escape_string($_POST["revisioncount"])."', ". + "changescount = '".$this->dbObject->escape_string($_POST["changescount"])."', ". + "motto = '".$this->dbObject->escape_string($_POST["motto"])."' ". + "where name = '".$user["name"]."'"); $this->SetUser($this->LoadUser($user["name"])); @@ -66,7 +67,7 @@ else if ($user["password"] != md5($_POST["oldpass"])) $error = "Mot de passe erroné !"; else { - $this->Query("update ".$this->GetConfigValue("table_prefix")."users set "."password = md5('".mysql_escape_string($password)."') "."where name = '".$user["name"]."'"); + $this->Query("update ".$this->GetConfigValue("table_prefix")."users set "."password = '".md5($this->dbObject->escape_string($password))."' "."where name = '".$user["name"]."'"); $this->SetMessage("Mot de passe changé !"); $user["password"]=md5($password); $this->SetUser($user); @@ -177,11 +178,12 @@ else if (strlen($password) < 5) $error = "Mot de passe trop court. Un mot de passe doit contenir au minimum 5 caractères alphanumériques."; else { - $this->Query("insert into ".$this->GetConfigValue("table_prefix")."users set ". - "signuptime = now(), ". - "name = '".mysql_escape_string($name)."', ". - "email = '".mysql_escape_string($email)."', ". - "password = md5('".mysql_escape_string($_POST["password"])."')"); + $this->Query("insert into ".$this->GetConfigValue("table_prefix")."users". + "(signuptime,name,email,password) ". + "VALUES ('".date('Y-m-d H:i:s')."', ". + "'".$this->dbObject->escape_string($name)."', ". + "'".$this->dbObject->escape_string($email)."', ". + "'".md5($this->dbObject->escape_string($_POST["password"]))."')"); // log in $this->SetUser($this->LoadUser($name)); Index: handlers/addcomment.php =================================================================== --- handlers/addcomment.php (revision 812) +++ handlers/addcomment.php (working copy) @@ -7,6 +7,7 @@ Copyright 2004 Jean Christophe ANDRÉ Copyright 2005 Didier LOISEAU Copyright 2006 Jean-Michel PHILIPPE +Copyright 2007 Xavier GARREAU All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions @@ -40,7 +41,7 @@ if ($this->HasAccess("comment") && $this->page && !$this->page['comment_on']) { // find number - $sql = 'SELECT MAX(SUBSTRING(tag, 8) + 0) AS comment_id' + $sql = 'SELECT MAX('.$this->dbObject->substr_name().'(tag, 8, length(tag)) + 0) AS comment_id' . ' FROM ' . $this->GetConfigValue('table_prefix') . 'pages' . ' WHERE comment_on != ""'; if ($lastComment = $this->LoadSingle($sql)) Index: includes/database.class.php =================================================================== --- includes/database.class.php (revision 0) +++ includes/database.class.php (revision 0) @@ -0,0 +1,216 @@ +link = NULL; + $this->nbReqs = 0; + } + + function query ($str) { + if (!$this->link) { + $this->link = @mysql_connect($this->host,$this->user,$this->pass); + if ($this->link) { + if (!@mysql_select_db($this->bdd, $this->link)) { + $this->link = NULL; + } + } + } + if ($this->link) { + ++$this->nbReqs; + return @mysql_query ($str, $this->link); + } else { + return NULL; + } + } + + function unbuffered_query ($str) { + if (!$this->link) { + $this->link = @mysql_connect($this->host,$this->user,$this->pass); + if ($this->link) { + if (!@mysql_select_db($this->bdd, $this->link)) { + $this->link = NULL; + } + } + } + if ($this->link) { + ++$this->nbReqs; + return @mysql_unbuffered_query ($str, $this->link); + } else { + return NULL; + } + } + + function fetch_assoc($results) { + return @mysql_fetch_array ($results); + } + + function fetch_object($results) { + return @mysql_fetch_object ($results); + } + + function free_result($results) { + return @mysql_free_result ($results); + } + + function escape_string($str) { + return @mysql_escape_string ($str); + } + + function close() { + return @mysql_close ($this->link); + } + + function num_rows($results) { + return @mysql_num_rows ($results); + } + + function error_string () { + if (!$this->lien) { + return @mysql_error ($this->link); + } + } + + function substr_name () { + // substr n'existe qu'à partir de MySQL-4.1 + return 'substring'; + } +} + +class base_sqlite { + /*******************************************************************/ + /*** La configuration SQLite est ici ;) ***/ + /*******************************************************************/ + /***/ var $dbpath = ''; /***/ + /*******************************************************************/ + + var $link; + var $nbReqs; + + function base_sqlite () { + $this->link = NULL; + $this->nbReqs = 0; + } + + function query($str) { + if (!$this->link) { + $this->link = @sqlite_open($this->dbpath, 0666); + } + if ($this->link) { + ++$this->nbReqs; + return sqlite_query ($str, $this->link, SQLITE_ASSOC); + } else { + return NULL; + } + } + + function unbuffered_query($str) { + if (!$this->link) { + $this->link = @sqlite_open($this->dbpath, 0666); + } + if ($this->link) { + ++$this->nbReqs; + return sqlite_unbuffered_query ($str, $this->link, SQLITE_ASSOC); + } else { + return NULL; + } + } + + function fetch_assoc($results) { + return @sqlite_fetch_array ($results); + } + + function fetch_object($results) { + $resul = @sqlite_fetch_array ( $results ); + if (!$resultat) { + return NULL; + } + + foreach ($result as $n => $v) { + $object->$n = $v; + } + + return $object; + } + + function free_result($results) { + return TRUE; + } + + function escape_string($str) { + return @sqlite_escape_string ($str); + } + + function num_rows($results) { + return @sqlite_num_rows ($results); + } + + function close() { + return @sqlite_close ($this->link); + } + + function error_string () { + if (!$this->link) { + return @sqlite_error_string(sqlite_last_error ($this->link)); + } + } + + function substr_name () { + return 'substr'; + } +} + +function database_constructor ($dbtype, $config) { + $constructor = 'base_'.$dbtype; + $dbObject = new $constructor(); + switch ($dbtype) { + case 'mysql': + $dbObject->host = $config['mysql_host']; + $dbObject->user = $config['mysql_user']; + $dbObject->pass = $config['mysql_password']; + $dbObject->bdd = $config['mysql_database']; + break; + case 'sqlite': + $dbObject->dbpath = $config['sqlite_dbpath']; + break; + } + return $dbObject; +} +?> Index: includes/wiki.class.php =================================================================== --- includes/wiki.class.php (revision 812) +++ includes/wiki.class.php (working copy) @@ -13,6 +13,7 @@ Copyright 2004-2006, Jean-Christophe ANDRÉ Copyright 2005-2006, Didier LOISEAU Copyright 2006-2007, Stéphane AULERY +Copyright 2007, Xavier GARREAU All rights reserved. Redistribution and use in source and binary forms, with or without @@ -41,7 +42,7 @@ class Wiki { // VARIABLES - var $dblink; + var $dbObject; var $page; var $parameter = array(); var $queryLog = array(); @@ -69,17 +70,13 @@ // if in debug mode, activate full error reporting if ($this->GetConfigValue('debug') === 'yes') error_reporting(E_ALL); - // some host do not allow mysql_pconnect - $this->dblink = @mysql_connect ( - $this->GetConfigValue("mysql_host"), - $this->GetConfigValue("mysql_user"), - $this->GetConfigValue("mysql_password")); + $this->dbObject = database_constructor ($this->GetConfigValue('dbtype'), $this->config); // check for database access - if ($this->dblink) { - if (!@mysql_select_db($this->GetConfigValue("mysql_database"), $this->dblink)) { - @mysql_close($this->dblink); - $this->dblink = false; + if ($this->dbObject) { + if (!$this->dbObject->query("SELECT 0")) { + $this->dbObject->close(); + $this->dbObject = NULL; } } else { @@ -108,10 +105,10 @@ { if($this->GetConfigValue("debug")) $start = $this->GetMicroTime(); - if (!$result = mysql_query($query, $this->dblink)) + if (!$result = $this->dbObject->query($query)) { ob_end_clean(); - die("Query failed : ".$query."\n(".mysql_error().")"); + die("Query failed : ".$query."\n(".$this->dbObject->error_string().")"); } if($this->GetConfigValue("debug")) @@ -131,12 +128,12 @@ if($this->GetConfigValue("debug")) $start = $this->GetMicroTime(); // Execute - $resulat = mysql_unbuffered_query($query, $this->dblink); + $resulat = $this->dbObject->unbuffered_query($query); if ($resulat == FALSE) { ob_end_clean(); - die("Query failed : ".$query."\n(".mysql_error().")"); + die("Query failed : ".$query."\n(".$this->dbObject->error_string().")"); } if($this->GetConfigValue("debug")) @@ -154,9 +151,9 @@ function LoadSingle($query) { if ($Result = $this->Query($query)) { - $data[] = mysql_fetch_assoc($Result); + $data[] = $this->dbObject->fetch_assoc($Result); - mysql_free_result($Result); + $this->dbObject->free_result($Result); return $data[0]; } @@ -168,8 +165,8 @@ $data=array(); if ($r = $this->Query($query)) { - while ($row = mysql_fetch_assoc($r)) $data[] = $row; - mysql_free_result($r); + while ($row = $this->dbObject->fetch_assoc($r)) $data[] = $row; + $this->dbObject->free_result($r); } return $data; @@ -270,8 +267,8 @@ function GetAllTriplesValues($resource, $property, $re_prefix = THISWIKI_PREFIX, $prop_prefix = WIKINI_VOC_PREFIX) { $sql = 'SELECT id, value FROM ' . $this->GetConfigValue('table_prefix') . 'triples ' - . 'WHERE resource = "' . addslashes($re_prefix . $resource) . '" ' - . 'AND property = "' . addslashes($prop_prefix . $property) . '" '; + . 'WHERE resource = "' . $this->dbObject->escape_string($re_prefix . $resource) . '" ' + . 'AND property = "' . $this->dbObject->escape_string($prop_prefix . $property) . '" '; return $this->LoadAll($sql); } @@ -305,9 +302,9 @@ function TripleExists($resource, $property, $value, $re_prefix = THISWIKI_PREFIX, $prop_prefix = WIKINI_VOC_PREFIX) { $sql = 'SELECT id FROM ' . $this->GetConfigValue('table_prefix') . 'triples ' - . 'WHERE resource = "' . addslashes($re_prefix . $resource) . '" ' - . 'AND property = "' . addslashes($prop_prefix . $property) . '" ' - . 'AND value = "' . addslashes($value) . '"'; + . 'WHERE resource = "' . $this->dbObject->escape_string($re_prefix . $resource) . '" ' + . 'AND property = "' . $this->dbObject->escape_string($prop_prefix . $property) . '" ' + . 'AND value = "' . $this->dbObject->escape_string($value) . '"'; $res = $this->LoadSingle($sql); if (!$res) return 0; @@ -329,10 +326,10 @@ { return 3; } - $sql = 'INSERT INTO ' . $this->GetConfigValue('table_prefix') . 'triples (resource, property, value)' - . 'VALUES ("' . addslashes($re_prefix . $resource) . '", "' - . addslashes($prop_prefix . $property) . '", "' - . addslashes($value) . '")'; + $sql = 'INSERT INTO ' . $this->GetConfigValue('table_prefix') . 'triples (resource, property, value) ' + . 'VALUES ("' . $this->dbObject->escape_string($re_prefix . $resource) . '", "' + . $this->dbObject->escape_string($prop_prefix . $property) . '", "' + . $this->dbObject->escape_string($value) . '")'; return $this->QueryOnly($sql) ? 0 : 1; } @@ -358,7 +355,7 @@ return 3; } $sql = 'UPDATE ' . $this->GetConfigValue('table_prefix') . 'triples ' - . 'SET value = "' . addslashes($newvalue) . '" ' + . 'SET value = "' . $this->dbObject->escape_string($newvalue) . '" ' . 'WHERE id = ' . $id; return $this->QueryOnly($sql) ? 0 : 1; @@ -376,9 +373,9 @@ function DeleteTriple($resource, $property, $value = null, $re_prefix = THISWIKI_PREFIX, $prop_prefix = WIKINI_VOC_PREFIX) { $sql = 'DELETE FROM ' . $this->GetConfigValue('table_prefix') . 'triples ' - . 'WHERE resource = "' . addslashes($re_prefix . $resource) . '" ' - . 'AND property = "' . addslashes($prop_prefix . $property) . '" '; - if ($value !== null) $sql .= 'AND value = "' . addslashes($value) . '"'; + . 'WHERE resource = "' . $this->dbObject->escape_string($re_prefix . $resource) . '" ' + . 'AND property = "' . $this->dbObject->escape_string($prop_prefix . $property) . '" '; + if ($value !== null) $sql .= 'AND value = "' . $this->dbObject->escape_string($value) . '"'; $this->QueryOnly($sql); } @@ -497,8 +494,8 @@ if (!isset($page)) { $page = $this->LoadSingle("SELECT * " ."FROM ".$this->GetConfigValue("table_prefix")."pages " - ."WHERE tag = '".mysql_escape_string($tag)."' " - .($time ? "AND time = '".mysql_escape_string($time)."'" : "AND latest = 'Y'") + ."WHERE tag = '".$this->dbObject->escape_string($tag)."' " + .($time ? "AND time = '".$this->dbObject->escape_string($time)."'" : "AND latest = 'Y'") ." LIMIT 1"); // cache result @@ -521,7 +518,7 @@ if (!isset($page)) { $page = $this->LoadSingle("SELECT * " ."FROM ".$this->GetConfigValue("table_prefix")."pages " - ."WHERE id = '".mysql_escape_string($id) + ."WHERE id = '".$this->dbObject->escape_string($id) ."' LIMIT 1"); $this->Cache->CachePage($page); @@ -534,7 +531,7 @@ { return $this->LoadAll("SELECT * " ."FROM ".$this->GetConfigValue("table_prefix")."pages " - ."WHERE tag = '".mysql_escape_string($page)."' " + ."WHERE tag = '".$this->dbObject->escape_string($page)."' " ."ORDER BY time DESC"); } @@ -542,7 +539,7 @@ { return $this->LoadAll("SELECT DISTINCT from_tag AS tag " ."FROM ".$this->GetConfigValue("table_prefix")."links " - ."WHERE to_tag = '".mysql_escape_string($tag)."' " + ."WHERE to_tag = '".$this->dbObject->escape_string($tag)."' " ."ORDER BY from_tag"); } @@ -570,11 +567,23 @@ function FullTextSearch($phrase) { - return $this->LoadAll("SELECT * " - ."FROM ".$this->GetConfigValue("table_prefix")."pages " - ."WHERE latest = 'Y' " - ."AND MATCH(tag, body) " - ."AGAINST('".mysql_escape_string($phrase)."')"); + switch ($this->GetConfigValue('dbtype')) { + case 'mysql' : + $sql = "SELECT * " + ."FROM ".$this->GetConfigValue("table_prefix")."pages " + ."WHERE latest = 'Y' " + ."AND MATCH(tag, body) " + ."AGAINST('".$this->dbObject->escape_string($phrase)."')"; + break; + case 'sqlite' : + $sql = "SELECT * " + ."FROM ".$this->GetConfigValue("table_prefix")."pages " + ."WHERE latest = 'Y' " + ."AND tag||body " + ."LIKE '%".$this->dbObject->escape_string($phrase)."%'"; + break; + } + return $this->LoadAll($sql); } function LoadWantedPages() @@ -607,19 +616,19 @@ ."ON T_Page.tag = T_Link.to_tag " ."WHERE T_Link.to_tag IS NULL " ."AND T_Page.latest = 'Y' " - ."AND tag = '".mysql_escape_string($tag)."'"); + ."AND tag = '".$this->dbObject->escape_string($tag)."'"); } function DeletePage($tag) { $this->QueryOnly("DELETE FROM ".$this->GetConfigValue("table_prefix")."pages " - ."WHERE tag='".mysql_escape_string($tag)."' " - ."OR comment_on='".mysql_escape_string($tag)."'"); + ."WHERE tag='".$this->dbObject->escape_string($tag)."' " + ."OR comment_on='".$this->dbObject->escape_string($tag)."'"); $this->QueryOnly("DELETE FROM ".$this->GetConfigValue("table_prefix")."links " - ."WHERE from_tag='".mysql_escape_string($tag)."' "); + ."WHERE from_tag='".$this->dbObject->escape_string($tag)."' "); $this->QueryOnly("DELETE FROM ".$this->GetConfigValue("table_prefix")."acls " - ."WHERE page_tag='".mysql_escape_string($tag)."' "); + ."WHERE page_tag='".$this->dbObject->escape_string($tag)."' "); $this->QueryOnly("DELETE FROM ".$this->GetConfigValue("table_prefix")."referrers " - ."WHERE page_tag='".mysql_escape_string($tag)."' "); + ."WHERE page_tag='".$this->dbObject->escape_string($tag)."' "); $this->Cache->RemoveExistingPage($tag); } @@ -651,22 +660,23 @@ // set all other revisions to old $this->QueryOnly("UPDATE ".$this->GetConfigValue("table_prefix")."pages " ."SET latest = 'N' " - ."WHERE tag = '".mysql_Escape_string($tag)."'"); + ."WHERE tag = '".$this->dbObject->escape_string($tag)."'"); // delete olds links about this page $this->QueryOnly("DELETE FROM ".$this->GetConfigValue("table_prefix")."links " - ."WHERE from_tag = '".mysql_escape_string($this->GetPageTag())."'"); + ."WHERE from_tag = '".$this->dbObject->escape_string($this->GetPageTag())."'"); } // add new revision - $this->QueryOnly("INSERT INTO ".$this->GetConfigValue("table_prefix")."pages SET " - ."tag = '".mysql_escape_string($tag)."', ". - ($comment_on ? "comment_on = '".mysql_escape_string($comment_on)."', " : ""). - "time = now(), ". - "owner = '".mysql_escape_string($owner)."', ". - "user = '".mysql_escape_string($user)."', ". - "latest = 'Y', ". - "body = '".mysql_escape_string(chop($body))."'"); + $this->QueryOnly("INSERT INTO ".$this->GetConfigValue("table_prefix")."pages" + ."(tag,comment_on,time,owner,user,latest,body) " + ."VALUES ('".$this->dbObject->escape_string($tag)."', ". + "'".$this->dbObject->escape_string($comment_on)."', ". + "'".date('Y-m-d H:i:s')."', ". + "'".$this->dbObject->escape_string($owner)."', ". + "'".$this->dbObject->escape_string($user)."', ". + "'Y', ". + "'".$this->dbObject->escape_string(chop($body))."')"); // Supprime du Cache l'ancienne version de la page $this->Cache->UnCachePage($tag); @@ -687,13 +697,16 @@ // let's search which pages versions we have to remove // this is necessary beacause even MySQL does not handel multi-tables deletes before version 4.0 $wnPages = $this->GetConfigValue('table_prefix') . 'pages'; + $datesub = date('Y-m-d H:i:s', + mktime(date('H'), date('i'), date('s'), + date('m'), date('d')-$days, date('Y'))); $sql = 'SELECT DISTINCT a.id FROM ' . $wnPages . ' a,' . $wnPages . ' b ' .'WHERE a.latest = \'N\' ' - .'AND a.time < date_sub(now(), INTERVAL \'' . addslashes($days) . '\' DAY) ' + .'AND a.time < \''.$datesub.'\' ' .'AND a.tag = b.tag ' .'AND a.time < b.time ' - .'AND b.time < date_sub(now(), INTERVAL \'' . addslashes($days) . '\' DAY)'; - + .'AND b.time < \''.$datesub.'\''; + $ids = $this->LoadAll($sql); if (count($ids)) { // there are some versions to remove from DB @@ -890,7 +903,7 @@ { // delete olds links about this page $this->QueryOnly("DELETE FROM ".$this->GetConfigValue("table_prefix")."links " - ."WHERE from_tag = '".mysql_escape_string($tag)."'"); + ."WHERE from_tag = '".$this->dbObject->escape_string($tag)."'"); $Page = $this->LoadPage($tag); @@ -899,20 +912,17 @@ foreach ($ListeDesLiens as $UnLien) { // Concaténer les valeurs, sauf si elle page pointe vers elle-même if ($tag != $UnLien) - $SQL_DATA .= "('".mysql_escape_string($tag)."','" - .mysql_escape_string($UnLien)."'),"; + // Portion fixe de la requête d'insetion + $SQL .= "INSERT INTO ".$this->GetConfigValue("table_prefix")."links (from_tag, to_tag) VALUES "; + $SQL .= "('".$this->dbObject->escape_string($tag)."','" + .$this->dbObject->escape_string($UnLien)."');"; } // On vérifie qu'en cas de lien unique à écrire, // il ne pointait pas vers la page courante (lien jamais écrit) - if (isset($SQL_DATA)) { - // Portion fixe de la requête d'insetion - $SQL = "INSERT INTO ".$this->GetConfigValue("table_prefix")."links (from_tag, to_tag) VALUES "; - // Supprimer la virgule terminal surnuméraire - $SQL_DATA = substr($SQL_DATA, 0, strlen($SQL_DATA) - 1); - + if (isset($SQL)) { // Ecrire la table - $this->QueryOnly($SQL . $SQL_DATA); + $this->QueryOnly($SQL); } } } @@ -1012,10 +1022,11 @@ // NB.: this does NOT exempt to htmlspecialchars() the collected URIs ! if (!preg_match('`^https?://`', $referrer)) return; - $this->QueryOnly("INSERT INTO ".$this->GetConfigValue("table_prefix")."referrers SET ". - "page_tag = '".mysql_escape_string($tag)."', ". - "referrer = '".mysql_escape_string($referrer)."', ". - "time = NOW()"); + $this->QueryOnly("INSERT INTO ".$this->GetConfigValue("table_prefix")."referrers". + "(page_tag,referrer,time) ". + "VALUES ('".$this->dbObject->escape_string($tag)."', ". + "'".$this->dbObject->escape_string($referrer)."', ". + "'".date('Y-m-d H:i:s')."')"); } } @@ -1023,7 +1034,7 @@ { return $this->LoadAll("SELECT referrer, COUNT(referrer) AS num " ."FROM ".$this->GetConfigValue("table_prefix")."referrers ".($tag = trim($tag) ? - "WHERE page_tag = '".mysql_escape_string($tag)."'" : "")." " + "WHERE page_tag = '".$this->dbObject->escape_string($tag)."'" : "")." " ."GROUP BY referrer " ."ORDER BY num DESC"); } @@ -1031,8 +1042,11 @@ function PurgeReferrers() { if ($days = $this->GetConfigValue("referrers_purge_time")) { + $datesub = date('Y-m-d H:i:s', + mktime(date('H'), date('i'), date('s'), + date('m'), date('d')-$days, date('Y'))); $this->QueryOnly("DELETE FROM ".$this->GetConfigValue("table_prefix")."referrers " - ."WHERE time < date_sub(now(), interval '".mysql_escape_string($days)."' day)"); + ."WHERE time < '$date_sub'"); } } @@ -1210,8 +1224,8 @@ { return $this->LoadSingle("SELECT * " ."FROM ".$this->GetConfigValue("table_prefix")."users " - ."WHERE name = '".mysql_escape_string($name)."' ".($password === 0 ? "" : - "AND password = '".mysql_escape_string($password)."'") + ."WHERE name = '".$this->dbObject->escape_string($name)."' ".($password === 0 ? "" : + "AND password = '".$this->dbObject->escape_string($password)."'") ." LIMIT 1"); } @@ -1277,9 +1291,9 @@ { return $this->LoadAll("SELECT * " . "FROM ".$this->GetConfigValue("table_prefix")."pages " . - "WHERE comment_on = '".mysql_escape_string($tag)."' " . + "WHERE comment_on = '".$this->dbObject->escape_string($tag)."' " . "AND latest = 'Y' " . - "ORDER BY substring(tag, 8) + 0 DESC"); + "ORDER BY ".$this->dbObject->substr_name()."(tag, 8, length(tag)) + 0 DESC"); } /** @@ -1309,7 +1323,7 @@ function LoadRecentlyCommentedNew($limit = 50) { - $pageTable = "`".$this->config["table_prefix"]."pages`"; + $pageTable = $this->config["table_prefix"]."pages"; $sql = "SELECT p1.comment_on as tag, p1.tag as comment_tag, p1.time as comment_time, p1.user as comment_user "; $sql .= "FROM $pageTable p1 "; $sql .= "WHERE p1.time = (SELECT max(p2.time) FROM $pageTable p2 "; @@ -1342,8 +1356,7 @@ { $comment = $this->LoadSingle("SELECT * " ."FROM ".$this->GetConfigValue("table_prefix")."pages " - ."WHERE id = '".$id["id"]."' " - ."LIMIT 1"); + ."WHERE id = '".$id["id"]."' "); // Put pages (comments) in cache $this->Cache->CachePage($comment); @@ -1431,10 +1444,9 @@ // updated latest revision with new owner $this->QueryOnly("UPDATE ".$this->GetConfigValue("table_prefix")."pages " - ."SET owner = '".mysql_escape_string($user)."' " - ."WHERE tag = '".mysql_escape_string($tag)."' " - ."AND latest = 'Y' " - ."LIMIT 1"); + ."SET owner = '".$this->dbObject->escape_string($user)."' " + ."WHERE tag = '".$this->dbObject->escape_string($tag)."' " + ."AND latest = 'Y' "); $this->Cache->UnCachePage($tag); } @@ -1443,9 +1455,9 @@ { if ((!$acl = $this->LoadSingle("SELECT * " ."FROM ".$this->GetConfigValue("table_prefix")."acls " - ."WHERE page_tag = '".mysql_escape_string($tag)."' " - ."AND privilege = '".mysql_escape_string($privilege)."' " - ."LIMIT 1")) && $useDefaults) + ."WHERE page_tag = '".$this->dbObject->escape_string($tag)."' " + ."AND privilege = '".$this->dbObject->escape_string($privilege) + ."' ")) && $useDefaults) { $acl = array("page_tag" => $tag, "privilege" => $privilege, @@ -1458,14 +1470,14 @@ function SaveAcl($tag, $privilege, $list) { if ($this->LoadAcl($tag, $privilege, 0)) $this->QueryOnly("UPDATE ".$this->GetConfigValue("table_prefix")."acls " - ."SET list = '".mysql_escape_string(trim(str_replace("\r", "", $list)))."' " - ."WHERE page_tag = '".mysql_escape_string($tag)."'" - ." AND privilege = '".mysql_escape_string($privilege)."' " - ."LIMIT 1"); - else $this->QueryOnly("INSERT INTO ".$this->GetConfigValue("table_prefix")."acls " - ."SET list = '".mysql_escape_string(trim(str_replace("\r", "", $list)))."'," - ."page_tag = '".mysql_escape_string($tag)."'," - ."privilege = '".mysql_escape_string($privilege)."'"); + ."SET list = '".$this->dbObject->escape_string(trim(str_replace("\r", "", $list)))."' " + ."WHERE page_tag = '".$this->dbObject->escape_string($tag)."'" + ." AND privilege = '".$this->dbObject->escape_string($privilege)."' "); + else $this->QueryOnly("INSERT INTO ".$this->GetConfigValue("table_prefix")."acls" + ."(list, page_tag, privilege) " + ."VALUES ('".$this->dbObject->escape_string(trim(str_replace("\r", "", $list)))."'," + ."'".$this->dbObject->escape_string($tag)."'," + ."'".$this->dbObject->escape_string($privilege)."')"); } // returns true if $user (defaults to current user) has access to $privilege on $page_tag (defaults to current page) Index: setup/default.php =================================================================== --- setup/default.php (revision 812) +++ setup/default.php (working copy) @@ -6,6 +6,7 @@ Copyright 2002, 2003, David DELON Copyright 2002, Patrick PAUL Copyright 2006, Stéphane Aulery +Copyright 2007, Xavier GARREAU All rights reserved. @@ -74,6 +75,17 @@
+ +

Si vous choisissez d'utiliser SQLite, vous n'avez pas besoin de remplir les champs spécifiques à MySQL ci-dessous.

+ +

+