libpreludedb/master: Correctly compare table name for IDMEFTime field

commit fb152c4c92e96a2d5a26e4307300deefbfd5e1b4
Author: Yoann Vandoorselaere <[email protected]>
Date:   Fri Jan 29 11:04:35 2010 +0100

    Correctly compare table name for IDMEFTime field
    
    The old implementation could use the CreateTime table, in place of
    the DetectTime table, when asked for the table handling a detect_time
    element.


========================================

 plugins/format/classic/classic-sql-join.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)

========================================

diff --git a/plugins/format/classic/classic-sql-join.c b/plugins/format/classic/classic-sql-join.c
index 9ef3d4b..3b5b962 100644
--- a/plugins/format/classic/classic-sql-join.c
+++ b/plugins/format/classic/classic-sql-join.c
@@ -108,11 +108,12 @@ classic_sql_joined_table_t *classic_sql_join_lookup_table(const classic_sql_join
         prelude_list_for_each(&join->tables, tmp) {
                 table = prelude_list_entry(tmp, classic_sql_joined_table_t, list);
                 if ( depth == idmef_path_get_depth(table->path) ) {
-                        if ( last_element_is_listed )
+                        if ( last_element_is_listed || (idmef_path_get_value_type(path, -1) == IDMEF_VALUE_TYPE_TIME && idmef_path_get_class(path, depth - 2) != IDMEF_CLASS_ID_FILE) )
                                 ret = idmef_path_compare(path, table->path);
                         else
                                 ret = idmef_path_ncompare(path, table->path, depth - 1);
 
+
                         if ( ret == 0 )
                                 return table;
                 }
_______________________________________________
Prelude-cvslog site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-cvslog