111 subparam fixes
This commit is contained in:
msyu
@@ -78,28 +78,26 @@
|
||||
<!--- нужна проверка на изоляцию тенантов --->
|
||||
|
||||
<cfquery name="local.qCheckExistence" result="local.result">
|
||||
select ios.instance_operation_cfs_subparam
|
||||
select count(*) as cnt
|
||||
from instance_operation_cfs_subparam ios
|
||||
where ios.instance_operation_cfs_param_uid=<cfqueryparam cfsqltype="cf_sql_other" value="#arguments.instanceOperationCfsParamUid#" null=#!isValid('guid',arguments.instanceOperationCfsParamUid)#/>
|
||||
AND ios.instance_operation_cfs_subparam=<cfqueryparam cfsqltype="cf_sql_varchar" value="#arguments.subparam#"/>
|
||||
</cfquery>
|
||||
<cfif local.qCheck.recordCount EQ 0>
|
||||
<cfif local.qCheckExistence.cnt EQ 0>
|
||||
<cfreturn representationOf(this.helper.formatMessage("Not Found", "Subparameter specified does not exist")).withStatus(404)/>
|
||||
</cfif>
|
||||
|
||||
<cfquery name="local.qCheckAccess" result="local.result">
|
||||
select iop.instance_operation_cfs_subparam
|
||||
from instance_operation_cfs_subparam ios
|
||||
join instance_operation_cfs_param iop on (ios.instance_operation_cfs_param_uid=iop.instance_operation_cfs_param_uid)
|
||||
select count(*) as cnt
|
||||
from instance_operation_cfs_param iop
|
||||
join instance_operation io on (iop.instance_operation_uid=io.instance_operation_uid)
|
||||
join instance e on (io.instance_uid=e.instance_uid)
|
||||
join specification_item si on (e.specification_item_id=si.specification_item_id)
|
||||
where ios.instance_operation_cfs_param_uid=<cfqueryparam cfsqltype="cf_sql_other" value="#arguments.instanceOperationCfsParamUid#" null=#!isValid('guid',arguments.instanceOperationCfsParamUid)#/>
|
||||
AND ios.instance_operation_cfs_subparam=<cfqueryparam cfsqltype="cf_sql_varchar" value="#arguments.subparam#"/>
|
||||
where iop.instance_operation_cfs_param_uid=<cfqueryparam cfsqltype="cf_sql_other" value="#arguments.instanceOperationCfsParamUid#" null=#!isValid('guid',arguments.instanceOperationCfsParamUid)#/>
|
||||
AND si.specification_id=<cfqueryparam cfsqltype="cf_sql_integer" value=#arguments.specificationId#/>
|
||||
</cfquery>
|
||||
<cfif local.qCheckAccess.recordCount EQ 0>
|
||||
<cfreturn representationOf(this.helper.formatMessage("Not Accessible", "Subparameter specified is not accessible by the current user")).withStatus(403)/>
|
||||
<cfif local.qCheckAccess.cnt EQ 0>
|
||||
<cfreturn representationOf(this.helper.formatMessage("Not Accessible", "CFS parameter specified is not accessible by the current user")).withStatus(403)/>
|
||||
</cfif>
|
||||
|
||||
<cfquery name="local.qSave">
|
||||
@@ -119,13 +117,13 @@
|
||||
|
||||
<cffunction name="put" hint="запись метаданных субпараметра CFS-параметра операции инстанса">
|
||||
<cfargument name="instanceOperationCfsParamUid" type="string" required=true hint="type:guid"/>
|
||||
<cfargument name="subparam" type="string" required=true hint="type:string"/>
|
||||
|
||||
<cfargument name="isSensitive" type="boolean" required=true/>
|
||||
<cfargument name="subparam" type="string" required=true hint="type:string"/>
|
||||
<cfargument name="isSensitive" type="boolean" required=false default=false hint="type:boolean"/>
|
||||
<cfargument name="note" type="string" required=false default=""/> <!--- *** XSS!!! --->
|
||||
|
||||
<cftry>
|
||||
<cfset this.helper.validateField(arguments, "instanceOperationCfsParamUid", "guid")/>
|
||||
<cfset this.helper.validateField(arguments, "isSensitive", "boolean")/>
|
||||
<!--- *** Нужна проверка, что операция не была выполнена, иначе она становится архивной --->
|
||||
|
||||
<cfcatch type="invalidParamValue">
|
||||
@@ -134,30 +132,28 @@
|
||||
</cftry>
|
||||
|
||||
<cfset var local={}/>
|
||||
|
||||
<cfquery name="local.qCheckExistence" result="local.result">
|
||||
select iop.instance_operation_cfs_subparam
|
||||
from instance_operation_cfs_subparam iop
|
||||
where iop.instance_operation_cfs_param_uid=<cfqueryparam cfsqltype="cf_sql_other" value="#arguments.instanceOperationCfsParamUid#" null=#!isValid('guid',arguments.instanceOperationCfsParamUid)#/>
|
||||
AND iop.instance_operation_cfs_subparam=<cfqueryparam cfsqltype="cf_sql_varchar" value="#arguments.subparam#"/>
|
||||
</cfquery>
|
||||
<cfif local.qCheck.recordCount EQ 0>
|
||||
<cfreturn representationOf(this.helper.formatMessage("Not Found", "Subparameter specified does not exist")).withStatus(404)/>
|
||||
</cfif>
|
||||
|
||||
<cfquery name="local.qCheckAccess" result="local.result">
|
||||
select iop.instance_operation_cfs_subparam
|
||||
from instance_operation_cfs_subparam ios
|
||||
join instance_operation_cfs_param iop on (ios.instance_operation_cfs_param_uid=iop.instance_operation_cfs_param_uid)
|
||||
select count(*) as cnt
|
||||
from instance_operation_cfs_param iop
|
||||
join instance_operation io on (iop.instance_operation_uid=io.instance_operation_uid)
|
||||
join instance e on (io.instance_uid=e.instance_uid)
|
||||
join specification_item si on (e.specification_item_id=si.specification_item_id)
|
||||
where iop.instance_operation_cfs_param_uid=<cfqueryparam cfsqltype="cf_sql_other" value="#arguments.instanceOperationCfsParamUid#" null=#!isValid('guid',arguments.instanceOperationCfsParamUid)#/>
|
||||
AND iop.instance_operation_cfs_subparam=<cfqueryparam cfsqltype="cf_sql_varchar" value="#arguments.subparam#"/>
|
||||
AND si.specification_id=<cfqueryparam cfsqltype="cf_sql_integer" value=#arguments.specificationId#/>
|
||||
</cfquery>
|
||||
<cfif local.qCheckAccess.recordCount EQ 0>
|
||||
<cfreturn representationOf(this.helper.formatMessage("Not Accessible", "Subparameter specified is not accessible by the current user")).withStatus(403)/>
|
||||
<cfif local.qCheckAccess.cnt EQ 0>
|
||||
<cfreturn representationOf(this.helper.formatMessage("Not Accessible", "Instance CFS parameter not found or access denied")).withStatus(404)/>
|
||||
</cfif>
|
||||
|
||||
<cfquery name="local.qCheckExistence" result="local.result">
|
||||
select count(*) as cnt
|
||||
from instance_operation_cfs_subparam iop
|
||||
where iop.instance_operation_cfs_param_uid=<cfqueryparam cfsqltype="cf_sql_other" value="#arguments.instanceOperationCfsParamUid#" null=#!isValid('guid',arguments.instanceOperationCfsParamUid)#/>
|
||||
AND iop.instance_operation_cfs_subparam=<cfqueryparam cfsqltype="cf_sql_varchar" value="#arguments.subparam#"/>
|
||||
</cfquery>
|
||||
<cfif local.qCheckExistence.cnt EQ 0>
|
||||
<cfreturn representationOf(this.helper.formatMessage("Not Found", "Subparameter specified does not exist")).withStatus(404)/>
|
||||
</cfif>
|
||||
|
||||
<cfquery name="local.qSave" result="local.result">
|
||||
@@ -167,7 +163,7 @@
|
||||
,is_sensitive=<cfqueryparam cfsqltype="cf_sql_bit" value="#arguments.isSensitive#" />
|
||||
,note=<cfqueryparam cfsqltype="cf_sql_varchar" value="#htmlEditFormat(arguments.note)#" /> <!--- *** XSS!!! --->
|
||||
where instance_operation_cfs_param_uid=<cfqueryparam cfsqltype="cf_sql_other" value="#arguments.instanceOperationCfsParamUid#" null=#!isValid('guid',arguments.instanceOperationCfsParamUid)#/>
|
||||
AND iop.instance_operation_cfs_subparam=<cfqueryparam cfsqltype="cf_sql_varchar" value="#arguments.subparam#"/>
|
||||
AND instance_operation_cfs_subparam=<cfqueryparam cfsqltype="cf_sql_varchar" value="#arguments.subparam#"/>
|
||||
</cfquery>
|
||||
<!--- *** проверить существование - 404 --->
|
||||
<cfreturn noData().withStatus(204, "No Content") />
|
||||
|
||||
Reference in New Issue
Block a user