[ php-blog-Bugs-3535944 ] Usage of serendipity_fetchComments() causes SQL errors

Bugs item #3535944, was opened at 2012-06-18 02:03
Message generated for change (Comment added) made by garvinhicking
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=542822&aid=3535944&group_id=75065

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: Frontend functions
Group: v0.6
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By:  (masterbilke)
Assigned to: Nobody/Anonymous (nobody)
Summary: Usage of serendipity_fetchComments() causes SQL errors

Initial Comment:
The SQL code which is generated in the function serendipity_fetchComments() causes (at least in postgresql) SQL syntax errors (see postgres logs).

Within the ORDER clause, the used column is missing (ORDER BY desc LIMIT 15). I assume that the following function calls causes the malformed query string.

./rss.php:43:    $latest_entry = serendipity_fetchComments(isset($_GET['cid']) ? $_GET['cid'] : null, 1, 'desc', false, $_GET['type']);
./rss.php:93:    $entries     = serendipity_fetchComments(isset($_GET['cid']) ? $_GET['cid'] : null, $serendipity['RSSfetchLimit'], 'desc', false, $_GET['type']);

They just pass "desc" for the order-argument of serendipity_fetchComments() which leads to a wrong substitution.

----------------------------------------------------------------------

>Comment By: Garvin Hicking (garvinhicking)
Date: 2012-06-18 03:15

Message:
Thanks for noticing; we also saw this last week and fixed it with this
commit:

https://github.com/s9y/Serendipity/commit/e8e1d511180287960a0059a40f2f9f00fc38a31d

We will incorporate this in the next release.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=542822&aid=3535944&group_id=75065

------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/