[TikiWiki-commits] [Git][tikiwiki/tiki][master] [FIX] Correct SQL error when wrong or invalid sort_mode in the URL

ushindi bienvenu pushed to branch master at Tiki Wiki CMS Groupware / Tiki


Commits:
3f13da13 by Alain Cisirika at 2026-05-04T09:07:10+00:00
[FIX] Correct SQL error when wrong or invalid sort_mode in the URL
---
* [FIX] Correct SQL error when wrong or invalid sort_mode in the URL

See merge request tikiwiki/tiki!10015

- - - - -


7 changed files:

- tiki-admin_newsletters.php
- tiki-admin_surveys.php
- tiki-list_blogs.php
- tiki-list_posts.php
- tiki-list_surveys.php
- tiki-newsletters.php
- tiki-survey_stats.php


Changes:

=====================================
tiki-admin_newsletters.php
=====================================
@@ -38,6 +38,7 @@ $inputConfiguration = [
 ];
 require_once('tiki-setup.php');
 use Tiki\Sections;
+use Tiki\SortModeValidator;
 $section = Sections::SECTION_ADMIN_LAYOUT;
 Sections::setCurrentSection($section);
 $access->check_feature('feature_newsletters');
@@ -199,11 +200,10 @@ if (isset($_REQUEST["save"]) && $access->checkCsrf()) {
     $smarty->assign('info', $info);
     $cookietab = 1;
 }
-if (! isset($_REQUEST["sort_mode"])) {
-    $sort_mode = 'created_desc';
-} else {
-    $sort_mode = $_REQUEST["sort_mode"];
-}
+$sort_mode = SortModeValidator::validateSortModeOrFeedback(
+    $_REQUEST['sort_mode'] ?? 'created_desc',
+    ['tiki_newsletters','tiki_sent_newsletters']
+);
 $offset = $_REQUEST["offset"] ?? 0;
 $smarty->assign_by_ref('offset', $offset);
 $find = $_REQUEST["find"] ?? '';


=====================================
tiki-admin_surveys.php
=====================================
@@ -28,6 +28,7 @@ $inputConfiguration = [
 require_once('tiki-setup.php');
 include_once('lib/surveys/surveylib.php');
 use Tiki\Sections;
+use Tiki\SortModeValidator;
 $section = Sections::SECTION_ADMIN_LAYOUT;
 Sections::setCurrentSection($section);
 $access->check_feature('feature_surveys');
@@ -115,11 +116,10 @@ if (isset($_REQUEST["remove"]) && $access->checkCsrf()) {
     $srvlib->remove_survey($_REQUEST["remove"]);
     Feedback::success(tr('The survey has been deleted successfully.'));
 }
-if (! isset($_REQUEST["sort_mode"])) {
-    $sort_mode = 'created_desc';
-} else {
-    $sort_mode = $_REQUEST["sort_mode"];
-}
+$sort_mode = SortModeValidator::validateSortModeOrFeedback(
+    $_REQUEST['sort_mode'] ?? 'created_desc',
+    ['tiki_surveys']
+);
 $offset = $_REQUEST["offset"] ?? 0;
 $smarty->assign_by_ref('offset', $offset);
 $find = $_REQUEST["find"] ?? '';


=====================================
tiki-list_blogs.php
=====================================
@@ -20,6 +20,7 @@ $inputConfiguration = [
 ];
 require_once('tiki-setup.php');
 use Tiki\Sections;
+use Tiki\SortModeValidator;
 $section = Sections::SECTION_BLOGS;
 Sections::setCurrentSection($section);
 $bloglib = TikiLib::lib('blog');
@@ -43,11 +44,10 @@ if (isset($_REQUEST["remove"]) && $access->checkCsrf()) {
 // for the information as the number of
 // days to get in the log 1,3,4,etc
 // it will default to 1 recovering information for today
-if (! isset($_REQUEST["sort_mode"])) {
-    $sort_mode = $prefs['blog_list_order'];
-} else {
-    $sort_mode = $_REQUEST["sort_mode"];
-}
+$sort_mode = SortModeValidator::validateSortModeOrFeedback(
+    $_REQUEST['sort_mode'] ?? $prefs['blog_list_order'],
+    ['tiki_blogs', 'tiki_blog_posts']
+) ?: 'created_desc';
 $smarty->assign_by_ref('sort_mode', $sort_mode);
 // If offset is set use it if not then use offset =0
 // use the maxRecords php variable to set the limit


=====================================
tiki-list_posts.php
=====================================
@@ -24,6 +24,7 @@ $inputConfiguration = [
     ],
 ];
 require_once('tiki-setup.php');
+use Tiki\SortModeValidator;
 $bloglib = TikiLib::lib('blog');
 $access->check_feature('feature_blogs');
 $access->check_permission('tiki_p_blog_admin');
@@ -41,11 +42,10 @@ if (isset($_REQUEST['checked']) && $access->checkCsrf()) {
     }
 }
 
-if (! isset($_REQUEST["sort_mode"])) {
-    $sort_mode = 'created_desc';
-} else {
-    $sort_mode = $_REQUEST["sort_mode"];
-}
+$sort_mode = SortModeValidator::validateSortModeOrFeedback(
+    $_REQUEST['sort_mode'] ?? 'created_desc',
+    ['tiki_blog_posts']
+);
 $smarty->assign_by_ref('sort_mode', $sort_mode);
 
 $offset = $_REQUEST["offset"] ?? 0;


=====================================
tiki-list_surveys.php
=====================================
@@ -20,16 +20,16 @@ $inputConfiguration = [
 require_once('tiki-setup.php');
 include_once('lib/surveys/surveylib.php');
 use Tiki\Sections;
+use Tiki\SortModeValidator;
 $section = Sections::SECTION_SURVEYS;
 Sections::setCurrentSection($section);
 $access->check_feature('feature_surveys');
 $access->check_permission('tiki_p_take_survey');
 
-if (! isset($_REQUEST["sort_mode"])) {
-    $sort_mode = 'created_desc';
-} else {
-    $sort_mode = $_REQUEST["sort_mode"];
-}
+$sort_mode = SortModeValidator::validateSortModeOrFeedback(
+    $_REQUEST['sort_mode'] ?? 'created_desc',
+    ['tiki_surveys']
+);
 $offset = $_REQUEST["offset"] ?? 0;
 $smarty->assign_by_ref('offset', $offset);
 $find = $_REQUEST["find"] ?? '';


=====================================
tiki-newsletters.php
=====================================
@@ -26,6 +26,7 @@ $inputConfiguration = [
 ];
 require_once('tiki-setup.php');
 use Tiki\Sections;
+use Tiki\SortModeValidator;
 $section = Sections::SECTION_NEWSLETTERS;
 Sections::setCurrentSection($section);
 global $nllib;
@@ -125,12 +126,10 @@ if (isset($_REQUEST["info"])) {
     $smarty->assign('nl_info', $nl_info);
     $smarty->assign('subscribe', 'y');
 }
-// List newsletters
-if (! isset($_REQUEST["sort_mode"])) {
-    $sort_mode = 'created_desc';
-} else {
-    $sort_mode = $_REQUEST["sort_mode"];
-}
+$sort_mode = SortModeValidator::validateSortModeOrFeedback(
+    $_REQUEST['sort_mode'] ?? 'created_desc',
+    ['tiki_newsletters','tiki_sent_newsletters']
+);
 $offset = $_REQUEST["offset"] ?? 0;
 if (isset($_REQUEST["noshowlist"])) {
     $showlist = 'n';


=====================================
tiki-survey_stats.php
=====================================
@@ -20,6 +20,7 @@ $inputConfiguration = [
 require_once('tiki-setup.php');
 include_once('lib/surveys/surveylib.php');
 use Tiki\Sections;
+use Tiki\SortModeValidator;
 $section = Sections::SECTION_SURVEYS;
 Sections::setCurrentSection($section);
 $auto_query_args = ['sort_mode', 'offset', 'find'];
@@ -27,11 +28,10 @@ $auto_query_args = ['sort_mode', 'offset', 'find'];
 $access->check_feature('feature_surveys');
 $access->check_permission('tiki_p_view_survey_stats');
 
-if (! isset($_REQUEST["sort_mode"])) {
-    $sort_mode = 'created_desc';
-} else {
-    $sort_mode = $_REQUEST["sort_mode"];
-}
+$sort_mode = SortModeValidator::validateSortModeOrFeedback(
+    $_REQUEST['sort_mode'] ?? 'created_desc',
+    ['tiki_surveys']
+);
 $offset = $_REQUEST["offset"] ?? 0;
 $smarty->assign_by_ref('offset', $offset);
 $find = $_REQUEST["find"] ?? '';



View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/3f13da13f39fd74b4bc2cd482a1fd75f57821bfb

-- 
View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/3f13da13f39fd74b4bc2cd482a1fd75f57821bfb
You're receiving this email because of your account on gitlab.com. Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help

_______________________________________________
TikiWiki-cvs mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tikiwiki-cvs