From aac68b96247a3ac1dad45e4c6d3b6284b688acaf Mon Sep 17 00:00:00 2001 From: Taras Machyshyn Date: Mon, 12 Jan 2015 11:21:44 +0200 Subject: [PATCH 1/2] Fix error when 'data' directory is not writable --- application/Espo/Core/Application.php | 5 ++++- application/Espo/Core/Container.php | 5 ++++- .../Espo/Core/Utils/Database/Orm/Converter.php | 6 ++++-- .../Core/Utils/Database/Orm/RelationManager.php | 7 ++++--- application/Espo/Core/Utils/Metadata.php | 13 ++----------- 5 files changed, 18 insertions(+), 18 deletions(-) diff --git a/application/Espo/Core/Application.php b/application/Espo/Core/Application.php index 8976c9f6d3..891a669cd9 100644 --- a/application/Espo/Core/Application.php +++ b/application/Espo/Core/Application.php @@ -244,7 +244,10 @@ class Application protected function initAutoloads() { $autoload = new \Espo\Core\Utils\Autoload($this->getContainer()->get('config'), $this->getMetadata(), $this->getContainer()->get('fileManager')); - $autoloadList = $autoload->getAll(); + + try { + $autoloadList = $autoload->getAll(); + } catch (\Exception $e) {} //bad permissions if (empty($autoloadList)) { return; diff --git a/application/Espo/Core/Container.php b/application/Espo/Core/Container.php index feb7f5db1c..90b45e8550 100644 --- a/application/Espo/Core/Container.php +++ b/application/Espo/Core/Container.php @@ -52,7 +52,10 @@ class Container $this->data[$name] = $obj; } else { - $className = $this->get('metadata')->get('app.loaders.' . ucfirst($name)); + try { + $className = $this->get('metadata')->get('app.loaders.' . ucfirst($name)); + } catch (\Exception $e) {} + if (!isset($className) || !class_exists($className)) { $className = '\Espo\Custom\Core\Loaders\\'.ucfirst($name); if (!class_exists($className)) { diff --git a/application/Espo/Core/Utils/Database/Orm/Converter.php b/application/Espo/Core/Utils/Database/Orm/Converter.php index 73dee61462..e1bc2799a3 100644 --- a/application/Espo/Core/Utils/Database/Orm/Converter.php +++ b/application/Espo/Core/Utils/Database/Orm/Converter.php @@ -91,8 +91,6 @@ class Converter $this->relationManager = new RelationManager($this->metadata); $this->metadataUtils = new \Espo\Core\Utils\Metadata\Utils($this->metadata); - - $this->entityDefs = $this->getMetadata()->get('entityDefs'); } @@ -103,6 +101,10 @@ class Converter protected function getEntityDefs() { + if (empty($this->entityDefs)) { + $this->entityDefs = $this->getMetadata()->get('entityDefs'); + } + return $this->entityDefs; } diff --git a/application/Espo/Core/Utils/Database/Orm/RelationManager.php b/application/Espo/Core/Utils/Database/Orm/RelationManager.php index 7c952e194e..76c2337df1 100644 --- a/application/Espo/Core/Utils/Database/Orm/RelationManager.php +++ b/application/Espo/Core/Utils/Database/Orm/RelationManager.php @@ -30,12 +30,9 @@ class RelationManager private $entityDefs; - public function __construct(\Espo\Core\Utils\Metadata $metadata) { $this->metadata = $metadata; - - $this->entityDefs = $this->getMetadata()->get('entityDefs'); } protected function getMetadata() @@ -45,6 +42,10 @@ class RelationManager protected function getEntityDefs() { + if (empty($this->entityDefs)) { + $this->entityDefs = $this->getMetadata()->get('entityDefs'); + } + return $this->entityDefs; } diff --git a/application/Espo/Core/Utils/Metadata.php b/application/Espo/Core/Utils/Metadata.php index 3ad2f00f6d..7a0702ebb9 100644 --- a/application/Espo/Core/Utils/Metadata.php +++ b/application/Espo/Core/Utils/Metadata.php @@ -63,8 +63,6 @@ class Metadata $this->unifier = new \Espo\Core\Utils\File\Unifier($this->fileManager); $this->converter = new \Espo\Core\Utils\Database\Converter($this, $this->fileManager); - - $this->init(!$this->isCached()); } protected function getConfig() @@ -72,7 +70,6 @@ class Metadata return $this->config; } - protected function getUnifier() { return $this->unifier; @@ -88,7 +85,6 @@ class Metadata return $this->converter; } - public function isCached() { if (!$this->getConfig()->get('useCache')) { @@ -102,7 +98,6 @@ class Metadata return false; } - public function init($reload = false) { $data = $this->getMetadataOnly(false, $reload); @@ -131,13 +126,12 @@ class Metadata protected function getData() { if (empty($this->meta) || !is_array($this->meta)) { - $this->init(); + $this->init(!$this->isCached()); } return $this->meta; } - /** * Get Metadata * @@ -151,7 +145,6 @@ class Metadata return Util::getValueByKey($this->getData(), $key, $default); } - /** * Get All Metadata context * @@ -163,7 +156,7 @@ class Metadata public function getAll($isJSON = false, $reload = false) { if ($reload) { - $this->init(); + $this->init(true); } if ($isJSON) { @@ -172,8 +165,6 @@ class Metadata return $this->meta; } - - /** * Get Metadata only without saving it to the a file and database sync * From 4ffcca797805d2cdee8e60c76ee65ce76a01f3d7 Mon Sep 17 00:00:00 2001 From: yuri Date: Mon, 12 Jan 2015 12:12:47 +0200 Subject: [PATCH 2/2] sanitize --- application/Espo/ORM/DB/Query/Base.php | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-) diff --git a/application/Espo/ORM/DB/Query/Base.php b/application/Espo/ORM/DB/Query/Base.php index 368f8b4eb1..3173ab3a7a 100644 --- a/application/Espo/ORM/DB/Query/Base.php +++ b/application/Espo/ORM/DB/Query/Base.php @@ -109,7 +109,7 @@ class Base if (!empty($params['additionalColumns']) && is_array($params['additionalColumns']) && !empty($params['relationName'])) { foreach ($params['additionalColumns'] as $column => $field) { - $selectPart .= ", `" . $this->toDb($params['relationName']) . "`." . $this->toDb($column) . " AS `{$field}`"; + $selectPart .= ", `" . $this->toDb($this->sanitize($params['relationName'])) . "`." . $this->toDb($this->sanitize($column)) . " AS `{$field}`"; } } @@ -397,7 +397,7 @@ class Base { if (strpos($orderBy, '.') !== false) { list($alias, $field) = explode('.', $orderBy); - $fieldPath = $this->toDb($alias) . '.' . $this->toDb($field); + $fieldPath = $this->toDb($alias) . '.' . $this->toDb($this->sanitize($field)); } else { $fieldPath = $this->getFieldPath($entity, $orderBy); } @@ -417,7 +417,7 @@ class Base $distinctPart = 'DISTINCT '; } - $selectPart = "{$aggregation}({$distinctPart}" . $this->toDb($entity->getEntityName()) . "." . $this->toDb($aggregationBy) . ") AS AggregateValue"; + $selectPart = "{$aggregation}({$distinctPart}" . $this->toDb($entity->getEntityName()) . "." . $this->toDb($this->sanitize($aggregationBy)) . ") AS AggregateValue"; return $selectPart; } @@ -523,7 +523,7 @@ class Base } break; default: - $fieldPath = $this->toDb($entity->getEntityName()) . '.' . $this->toDb($field) ; + $fieldPath = $this->toDb($entity->getEntityName()) . '.' . $this->toDb($this->sanitize($field)); } return $fieldPath; @@ -588,8 +588,8 @@ class Base } } } - } else { - $leftPart = $this->toDb($entity->getEntityName()) . '.' . $this->toDb($field); + } else { + $leftPart = $this->toDb($entity->getEntityName()) . '.' . $this->toDb($this->sanitize($field)); } } } @@ -619,6 +619,11 @@ class Base return implode(" " . $sqlOp . " ", $whereParts); } + protected function sanitize($string) + { + return preg_replace('/[^A-Za-z0-9_]+/', '', $string); + } + protected function getJoins(IEntity $entity, array $joins, $left = false, $joinConditions = array()) { $joinsArr = array(); @@ -660,7 +665,7 @@ class Base $conditions = array_merge($conditions, $relOpt['conditions']); } foreach ($conditions as $f => $v) { - $join .= " AND {$relTable}." . $this->toDb($f) . " = " . $this->pdo->quote($v); + $join .= " AND {$relTable}." . $this->toDb($this->sanitize($f)) . " = " . $this->pdo->quote($v); } $join .= " {$pre}JOIN `{$distantTable}` ON {$distantTable}." . $this->toDb($foreignKey) . " = {$relTable}." . $this->toDb($distantKey)