Account Options

  1. Sign in
The old Google Groups will be going away soon, but your browser is incompatible with the new version.
Google Groups Home
« Groups Home
setQuery() method in JDatabase
There are currently too many topics in this group that display first. To make this topic appear first, remove this option from another topic.
There was an error processing your request. Please try again.
flag
  12 messages - Collapse all  -  Translate all to Translated (View all originals)
The group you are posting to is a Usenet group. Messages posted to this group will make your email address visible to anyone on the Internet.
Your reply message has not been sent.
Your post was successful
 
From:
To:
Cc:
Followup To:
Add Cc | Add Followup-to | Edit Subject
Subject:
Validation:
For verification purposes please type the characters you see in the picture below or the numbers you hear by clicking the accessibility icon. Listen and type the numbers you hear
 
Mark Dexter  
View profile  
 More options May 1 2012, 7:54 pm
From: Mark Dexter <dextercow...@gmail.com>
Date: Tue, 1 May 2012 16:54:57 -0700
Local: Tues, May 1 2012 7:54 pm
Subject: setQuery() method in JDatabase

In the setQuery() method we have the following code:

$this->limit = (int) $limit;
$this->offset = (int) $offset;

This code ensures we get integers, but we can still get SQL errors if one
of these values is negative.

If we prevented negative numbers for these values (with something like the
following), we would prevent this type of SQL error and I think still
support all valid use cases:

$this->limit = ((int) $limit >= 0) ? (int) $limit : 0;
$this->offset = ((int) $offset >= 0) ? (int) $offset : 0;

This would prevent possible information disclosures caused by someone
deliberately trying to cause a SQL error.

What do people think? Thanks. Mark


 
You must Sign in before you can post messages.
To post a message you must first join this group.
Please update your nickname on the subscription settings page before posting.
You do not have the permission required to post.
Andrew Eddie  
View profile  
 More options May 1 2012, 8:10 pm
From: Andrew Eddie <mambob...@gmail.com>
Date: Wed, 2 May 2012 10:10:42 +1000
Local: Tues, May 1 2012 8:10 pm
Subject: Re: [jplatform] setQuery() method in JDatabase
Sounds fine.

Regards,
Andrew Eddie
http://learn.theartofjoomla.com - training videos for Joomla developers

On 2 May 2012 09:54, Mark Dexter <dextercow...@gmail.com> wrote:


 
You must Sign in before you can post messages.
To post a message you must first join this group.
Please update your nickname on the subscription settings page before posting.
You do not have the permission required to post.
Chris Davenport  
View profile  
 More options May 2 2012, 12:51 am
From: Chris Davenport <chris.davenp...@joomla.org>
Date: Wed, 2 May 2012 05:51:47 +0100
Local: Wed, May 2 2012 12:51 am
Subject: Re: [jplatform] setQuery() method in JDatabase

$this->limit = abs( (int) $limit );

Avoiding the conditional?

Chris.

On 2 May 2012 01:10, Andrew Eddie <mambob...@gmail.com> wrote:

--
Chris Davenport
Joomla Leadership Team - Production Working Group
Joomla Documentation Coordinator

 
You must Sign in before you can post messages.
To post a message you must first join this group.
Please update your nickname on the subscription settings page before posting.
You do not have the permission required to post.
84.le0n  
View profile   Translate to Translated (View Original)
 More options May 2 2012, 4:36 am
From: "84.le0n" <84.l...@gmail.com>
Date: Wed, 2 May 2012 10:36:16 +0200
Local: Wed, May 2 2012 4:36 am
Subject: Re: [jplatform] setQuery() method in JDatabase

Il giorno 02/mag/2012, alle ore 06:51, Chris Davenport <chris.davenp...@joomla.org> ha scritto:

> $this->limit = abs( (int) $limit );

> Avoiding the conditional?

> Chris.

It's a better solution.

Just a proposal: each driver has to manage and format these values in different manner inside it's own query, so why don't add "limit" and "offset" inside JDatabaseElement, as I already did inside Postgresql's driver, for 3.0 or 3.5 release ?

Eng. Gabriele Pongelli

AVVERTENZE AI SENSI DEL D.LGS. 196/2003
Le informazioni contenute in questo messaggio di posta elettronica e negli eventuali files allegati, sono da considerarsi strettamente riservati. Il loro utilizzo è consentito esclusivamente al destinatario del messaggio, per le finalità indicate nel messaggio stesso. Qualora riceveste per errore questo messaggio, Vi preghiamo cortesemente di darcene notizia all'indirizzo e-mail di cui sopra e di procedere alla distruzione del messaggio stesso, cancellandolo dal Vostro sistema; costituisce comportamento contrario ai principi dettati dal D.lgs. 196/2003 il trattenere il messaggio stesso, divulgarlo anche in parte, distribuirlo ad altri soggetti, copiarlo, od utilizzarlo per finalità diverse.
This electronic transmission is strictly confidential and intended solely for the addresses. It may contain information which is covered by legal, professional or other privilege. If you are not the intended addressee, you must not disclose, copy or take any action in reliance of this transmission. If you have received this transmission in error, please notify us and delete the received data as soon as possible


 
You must Sign in before you can post messages.
To post a message you must first join this group.
Please update your nickname on the subscription settings page before posting.
You do not have the permission required to post.
Will Daniels  
View profile  
 More options May 2 2012, 6:28 am
From: Will Daniels <m...@willdaniels.co.uk>
Date: Wed, 02 May 2012 11:28:13 +0100
Local: Wed, May 2 2012 6:28 am
Subject: Re: [jplatform] setQuery() method in JDatabase
On 02/05/12 09:36, 84.le0n wrote:

> Just a proposal: each driver has to manage and format these values in different manner inside it's own query, so why don't add "limit" and "offset" inside JDatabaseElement, as I already did inside Postgresql's driver, for 3.0 or 3.5 release ?

+1

It's fine for SELECT ... LIMIT OFFSET syntax to just append to the SQL, but for
other syntax it all gets a bit hacky[1] trying to rewrite the query, which
naturally involves making some assumptions.

-Will

[1]
https://github.com/wdaniels/joomla-cms/blob/odbc-driver/libraries/joo...


 
You must Sign in before you can post messages.
To post a message you must first join this group.
Please update your nickname on the subscription settings page before posting.
You do not have the permission required to post.
Ian  
View profile  
 More options May 2 2012, 10:06 am
From: Ian <ianlen...@gmail.com>
Date: Wed, 2 May 2012 07:06:38 -0700 (PDT)
Local: Wed, May 2 2012 10:06 am
Subject: Re: setQuery() method in JDatabase

I'm inclined to think that if $limit or $offset is less than 0 you throw an
InvalidArgument exception.

Ian


 
You must Sign in before you can post messages.
To post a message you must first join this group.
Please update your nickname on the subscription settings page before posting.
You do not have the permission required to post.
Amy Stephen  
View profile  
 More options May 2 2012, 11:00 am
From: Amy Stephen <amystep...@gmail.com>
Date: Wed, 2 May 2012 10:00:48 -0500
Local: Wed, May 2 2012 11:00 am
Subject: Re: [jplatform] Re: setQuery() method in JDatabase

Agree with Mark to prevent the disclosure due to a fatal error.

Agree with Ian on the approach.


 
You must Sign in before you can post messages.
To post a message you must first join this group.
Please update your nickname on the subscription settings page before posting.
You do not have the permission required to post.
Niels Braczek  
View profile  
 More options May 2 2012, 10:02 am
From: Niels Braczek <nbrac...@bsds.de>
Date: Wed, 02 May 2012 16:02:36 +0200
Local: Wed, May 2 2012 10:02 am
Subject: Re: [jplatform] Re: setQuery() method in JDatabase
Am 02.05.2012 16:06, schrieb Ian:

> I'm inclined to think that if $limit or $offset is less than 0 you throw an
> InvalidArgument exception.

That's much cleaner than producing unpredictable[tm] results by
manipulating the input data.

Regards,
Niels

--
| http://barcamp-wk.de  ·  1. Barcamp Westküste  30./31. März 2012 |
| http://www.bsds.de   ·   BSDS Braczek Software- und DatenSysteme |
| Webdesign · Webhosting · e-Commerce · Joomla! Content Management |
 ------------------------------------------------------------------


 
You must Sign in before you can post messages.
To post a message you must first join this group.
Please update your nickname on the subscription settings page before posting.
You do not have the permission required to post.
Mark Dexter  
View profile  
 More options May 2 2012, 11:08 am
From: Mark Dexter <dextercow...@gmail.com>
Date: Wed, 2 May 2012 08:08:12 -0700
Local: Wed, May 2 2012 11:08 am
Subject: Re: [jplatform] Re: setQuery() method in JDatabase

What if the input is not an integer? Currently we are converting to
integer. Should we throw an exception also if either value is a
non-integer? Thanks. Mark


 
You must Sign in before you can post messages.
To post a message you must first join this group.
Please update your nickname on the subscription settings page before posting.
You do not have the permission required to post.
Niels Braczek  
View profile  
 More options May 2 2012, 10:24 am
From: Niels Braczek <nbrac...@bsds.de>
Date: Wed, 02 May 2012 16:24:35 +0200
Local: Wed, May 2 2012 10:24 am
Subject: Re: [jplatform] Re: setQuery() method in JDatabase
Am 02.05.2012 17:08, schrieb Mark Dexter:

> What if the input is not an integer? Currently we are converting to
> integer. Should we throw an exception also if either value is a
> non-integer? Thanks. Mark

Although I think that casting is acceptable, an Exception would be the
cleaner way, which I would prefer.

Regards,
Niels

--
| http://barcamp-wk.de  ·  1. Barcamp Westküste  30./31. März 2012 |
| http://www.bsds.de   ·   BSDS Braczek Software- und DatenSysteme |
| Webdesign · Webhosting · e-Commerce · Joomla! Content Management |
 ------------------------------------------------------------------


 
You must Sign in before you can post messages.
To post a message you must first join this group.
Please update your nickname on the subscription settings page before posting.
You do not have the permission required to post.
Amy Stephen  
View profile  
 More options May 2 2012, 12:30 pm
From: Amy Stephen <amystep...@gmail.com>
Date: Wed, 2 May 2012 11:30:35 -0500
Local: Wed, May 2 2012 12:30 pm
Subject: Re: [jplatform] Re: setQuery() method in JDatabase

Good point, Mark. I guess the question is - what is the API in this case?
If it's not clear, then maybe deciding what input is required is the first
step. Certainly makes it easier to code with those decisions in place.


 
You must Sign in before you can post messages.
To post a message you must first join this group.
Please update your nickname on the subscription settings page before posting.
You do not have the permission required to post.
CirTap  
View profile  
 More options May 2 2012, 5:47 am
From: CirTap <c...@webmechanic.biz>
Date: Wed, 02 May 2012 11:47:50 +0200
Local: Wed, May 2 2012 5:47 am
Subject: Re: [jplatform] setQuery() method in JDatabase
Am 02.05.2012 06:51, schrieb Chris Davenport:

> $this->limit = abs( (int) $limit );

> Avoiding the conditional?

using abs() will create a very different result than what Mark suggested
  $limit = -5;
  $this->limit = abs( (int) $limit )
= 5

this will clamp negative numbers to Zero which seems more safe to me
  $limit = -5;
  $this->limit = ((int) $limit >= 0) ? (int) $limit : 0;
= 0;

To avoid the explicit condition, the repetitive type conversion and
clamp negative numbers to zero:
  $limit = -5;
  $this->limit = (int) max(0, $limit);
= 0

CirTap


 
You must Sign in before you can post messages.
To post a message you must first join this group.
Please update your nickname on the subscription settings page before posting.
You do not have the permission required to post.
End of messages
« Back to Discussions « Newer topic     Older topic »