use proper types in API (fossar#879)

niol · Mar 14, 2017 · a1a60e9 · a1a60e9
1 parent ec0c8a4
commit a1a60e9
Show file tree

Hide file tree

Showing 6 changed files with 20 additions and 7 deletions.
diff --git a/controllers/Sources.php b/controllers/Sources.php
@@ -165,7 +165,7 @@ public function write() {
         unset($data['ajax']);
 
         // check if source already exists
-        $id = \F3::get('PARAMS["id"]');
+        $id = intval(\F3::get('PARAMS["id"]'));
         $sourceExists = $sourcesDao->isValid('id', $id);
 
         // load password value if not changed for spouts containing passwords

diff --git a/daos/mysql/Items.php b/daos/mysql/Items.php
@@ -331,7 +331,12 @@ public function get($options = []) {
             $query = "$select $where_sql $order_sql LIMIT " . $options['items'] . ' OFFSET ' . $options['offset'];
         }
 
-        return \F3::get('db')->exec($query, $params);
+        return $this->stmt->ensureRowTypes(\F3::get('db')->exec($query, $params), [
+            'id' => \PDO::PARAM_INT,
+            'unread' => \PDO::PARAM_BOOL,
+            'starred' => \PDO::PARAM_BOOL,
+            'source' => \PDO::PARAM_INT
+        ]);
     }
 
     /**

diff --git a/daos/mysql/Sources.php b/daos/mysql/Sources.php
@@ -144,13 +144,15 @@ public function get($id = null) {
         // select source by id if specified or return all sources
         if (isset($id)) {
             $ret = \F3::get('db')->exec('SELECT id, title, tags, spout, params, filter, error FROM ' . \F3::get('db_prefix') . 'sources WHERE id=:id', [':id' => $id]);
+            $this->stmt->ensureRowTypes($ret, ['id' => \PDO::PARAM_INT]);
             if (isset($ret[0])) {
                 $ret = $ret[0];
             } else {
                 $ret = false;
             }
         } else {
             $ret = \F3::get('db')->exec('SELECT id, title, tags, spout, params, filter, error FROM ' . \F3::get('db_prefix') . 'sources ORDER BY error DESC, lower(title) ASC');
+            $this->stmt->ensureRowTypes($ret, ['id' => \PDO::PARAM_INT]);
         }
 
         return $ret;
@@ -162,13 +164,18 @@ public function get($id = null) {
      * @return mixed all sources
      */
     public function getWithUnread() {
-        return \F3::get('db')->exec('SELECT
+        $ret = \F3::get('db')->exec('SELECT
             sources.id, sources.title, COUNT(items.id) AS unread
             FROM ' . \F3::get('db_prefix') . 'sources AS sources
             LEFT OUTER JOIN ' . \F3::get('db_prefix') . 'items AS items
                  ON (items.source=sources.id AND ' . $this->stmt->isTrue('items.unread') . ')
             GROUP BY sources.id, sources.title
             ORDER BY lower(sources.title) ASC');
+
+        return $this->stmt->ensureRowTypes($ret, [
+            'id' => \PDO::PARAM_INT,
+            'unread' => \PDO::PARAM_INT
+        ]);
     }
 
     /**
@@ -194,7 +201,7 @@ public function getWithIcon() {
                 ON sources.id=sourceicons.source
             ORDER BY ' . $this->stmt->nullFirst('sources.error', 'DESC') . ', lower(sources.title)');
 
-        return $ret;
+        return $this->stmt->ensureRowTypes($ret, ['id' => \PDO::PARAM_INT]);
     }
 
     /**

diff --git a/daos/mysql/Statements.php b/daos/mysql/Statements.php
@@ -22,7 +22,7 @@ public static function insert($query, $params) {
         \F3::get('db')->exec($query, $params);
         $res = \F3::get('db')->exec('SELECT LAST_INSERT_ID() as lastid');
 
-        return $res[0]['lastid'];
+        return intval($res[0]['lastid']);
     }
 
     /**

diff --git a/daos/mysql/Tags.php b/daos/mysql/Tags.php
@@ -87,7 +87,8 @@ public function getWithUnread() {
                    GROUP BY tags.tag, tags.color
                    ORDER BY LOWER(tags.tag);';
 
-        return \F3::get('db')->exec($select);
+        return $this->stmt->ensureRowTypes(\F3::get('db')->exec($select),
+                                           ['unread' => \PDO::PARAM_INT]);
     }
 
     /**

diff --git a/daos/sqlite/Statements.php b/daos/sqlite/Statements.php
@@ -22,7 +22,7 @@ public static function insert($query, $params) {
         \F3::get('db')->exec($query, $params);
         $res = \F3::get('db')->exec('SELECT last_insert_rowid() as lastid');
 
-        return $res[0]['lastid'];
+        return intval($res[0]['lastid']);
     }
 
     /**