From e4832ee8784642d985e8393e522c8f4f95f44556 Mon Sep 17 00:00:00 2001
From: msyu <msyu@mail.ru>
Date: Fri, 16 May 2025 17:15:05 +0300
Subject: [PATCH] 108 bookmark claen fix

---
 v1/Application.cfc                               |  2 +-
 v1/resources/bookmark.cfc                        |  6 +++---
 v1/resources/bookmark_ls.cfc                     |  4 ++--
 v1/resources/instance_operation.cfc              |  2 +-
 v1/resources/instance_operation_cfs_param.cfc    |  2 +-
 v1/resources/instance_operation_cfs_subparam.cfc | 14 +++++++-------
 6 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/v1/Application.cfc b/v1/Application.cfc
index e3d885c..b15dd17 100644
--- a/v1/Application.cfc
+++ b/v1/Application.cfc
@@ -51,7 +51,7 @@
 		
 		//variables.framework.docs={};
 		variables.framework.docs.APIName="Deck API";
-		variables.framework.docs.APIVersion="0.107"; /*$ git config --global --unset user.password*/
+		variables.framework.docs.APIVersion="0.108"; /*$ git config --global --unset user.password*/
 
 		
 		variables.framework.globalHeaders = structNew();
diff --git a/v1/resources/bookmark.cfc b/v1/resources/bookmark.cfc
index 1c4ff56..bee6c0d 100644
--- a/v1/resources/bookmark.cfc
+++ b/v1/resources/bookmark.cfc
@@ -81,13 +81,13 @@
 					,descr=<cfqueryparam cfsqltype="cf_sql_varchar" value="#cleanInput(arguments.descr)#"/>		
 				</cfif>				
 				<cfif structKeyExists(arguments,"url")>
-					,url=<cfqueryparam cfsqltype="cf_sql_varchar" value="#cleanInput(arguments.url)#"/>		
+					,url=<cfqueryparam cfsqltype="cf_sql_varchar" value="#arguments.url#"/>		
 				</cfif>				
 				<cfif structKeyExists(arguments,"iconUrl")>
-					,icon_url=<cfqueryparam cfsqltype="cf_sql_varchar" value="#cleanInput(arguments.iconUrl)#"/>		
+					,icon_url=<cfqueryparam cfsqltype="cf_sql_varchar" value="#arguments.iconUrl#"/>		
 				</cfif>				
 				<cfif structKeyExists(arguments,"sort")>
-					,sort=<cfqueryparam cfsqltype="cf_sql_integer" value="#cleanInput(arguments.sort)#"/>		
+					,sort=<cfqueryparam cfsqltype="cf_sql_integer" value="#arguments.sort#"/>		
 				</cfif>				
 				<cfif structKeyExists(arguments,"isEnabled")>
 					,is_enabled=<cfqueryparam cfsqltype="cf_sql_bit" value="#arguments.isEnabled#"/>		
diff --git a/v1/resources/bookmark_ls.cfc b/v1/resources/bookmark_ls.cfc
index 76e06ca..36dfa71 100644
--- a/v1/resources/bookmark_ls.cfc
+++ b/v1/resources/bookmark_ls.cfc
@@ -146,8 +146,8 @@
 					 <cfqueryparam cfsqltype="cf_sql_other" value="#local.bookmarkUid#"/>
 					,<cfqueryparam cfsqltype="cf_sql_integer" value="#arguments.contragentId#"/>
 					,<cfqueryparam cfsqltype="cf_sql_varchar" value="#cleanInput(arguments.bookmark)#"/>
-					,<cfqueryparam cfsqltype="cf_sql_varchar" value="#cleanInput(arguments.url)#"/>
-					,<cfqueryparam cfsqltype="cf_sql_varchar" value="#cleanInput(arguments.iconUrl)#"/>
+					,<cfqueryparam cfsqltype="cf_sql_varchar" value="#arguments.url#"/>
+					,<cfqueryparam cfsqltype="cf_sql_varchar" value="#arguments.iconUrl#"/>
 					,<cfqueryparam cfsqltype="cf_sql_varchar" value="#cleanInput(arguments.descr)#"/>					
 					,<cfqueryparam cfsqltype="cf_sql_integer" value="#arguments.sort#"/>
 					,<cfqueryparam cfsqltype="cf_sql_bit" value="#arguments.isEnabled#" null=#!isValid("boolean",arguments.isEnabled)#/>
diff --git a/v1/resources/instance_operation.cfc b/v1/resources/instance_operation.cfc
index f0b6561..74bbc64 100644
--- a/v1/resources/instance_operation.cfc
+++ b/v1/resources/instance_operation.cfc
@@ -186,7 +186,7 @@
 				select 
 					 sp.instance_operation_cfs_param_uid::text as instance_operation_cfs_param_uid
 					,sp.instance_operation_cfs_subparam								
-					,sp.descr								
+					,sp.note								
 					,sp.sort
 					,sp.is_sensitive
 				from instance_operation_cfs_subparam sp
diff --git a/v1/resources/instance_operation_cfs_param.cfc b/v1/resources/instance_operation_cfs_param.cfc
index 4de2c91..6f3e8d2 100644
--- a/v1/resources/instance_operation_cfs_param.cfc
+++ b/v1/resources/instance_operation_cfs_param.cfc
@@ -29,7 +29,7 @@
 				<m:field>iop.instance_operation_uid::text as instance_operation_uid</m:field>
 				<m:field>iop.svc_operation_cfs_param_id</m:field>
 				<!--- <m:field>iop.param_value</m:field> --->
-				<m:field>case when sop.is_sensitive then '********' else iop.param_value end as param_value </m:field>
+				<m:field>case when sop.is_sensitive then '********' else iop.param_value end as param_value </m:field><!--- внимание! если параметр типа MAP, то значение нужно разобрать и замаскировать секреты --->
 				<m:field>iop.note</m:field>
 				<m:field>to_char(iop.dt_created, 'YYYY-MM-DD"T"HH24:MI:SS.FF3TZHTZM') as dt_created</m:field>
 				<m:field>iop.creator_id</m:field>
diff --git a/v1/resources/instance_operation_cfs_subparam.cfc b/v1/resources/instance_operation_cfs_subparam.cfc
index 4864bde..3869d9f 100644
--- a/v1/resources/instance_operation_cfs_subparam.cfc
+++ b/v1/resources/instance_operation_cfs_subparam.cfc
@@ -161,13 +161,13 @@
 		</cfif>
 		
 		<cfquery name="local.qSave" result="local.result">
-		update instance_operation_cfs_subparam set
-		 dt_updated=<cfqueryparam cfsqltype="cf_sql_timestamp" value="#Now()#" />
-		,updater_id=<cfqueryparam cfsqltype="cf_sql_integer" value="#arguments.usrId#" />
-		,is_sensitive=<cfqueryparam cfsqltype="cf_sql_bit" value="#arguments.isSensitive#" />	
-		,note=<cfqueryparam cfsqltype="cf_sql_varchar" value="#htmlEditFormat(arguments.note)#" />	<!--- *** XSS!!! --->
-		where instance_operation_cfs_param_uid=<cfqueryparam cfsqltype="cf_sql_other" value="#arguments.instanceOperationCfsParamUid#" null=#!isValid('guid',arguments.instanceOperationCfsParamUid)#/>
-		AND iop.instance_operation_cfs_subparam=<cfqueryparam cfsqltype="cf_sql_varchar" value="#arguments.subparam#"/>
+			update instance_operation_cfs_subparam set
+			 dt_updated=<cfqueryparam cfsqltype="cf_sql_timestamp" value="#Now()#" />
+			,updater_id=<cfqueryparam cfsqltype="cf_sql_integer" value="#arguments.usrId#" />
+			,is_sensitive=<cfqueryparam cfsqltype="cf_sql_bit" value="#arguments.isSensitive#" />	
+			,note=<cfqueryparam cfsqltype="cf_sql_varchar" value="#htmlEditFormat(arguments.note)#" />	<!--- *** XSS!!! --->
+			where instance_operation_cfs_param_uid=<cfqueryparam cfsqltype="cf_sql_other" value="#arguments.instanceOperationCfsParamUid#" null=#!isValid('guid',arguments.instanceOperationCfsParamUid)#/>
+			AND iop.instance_operation_cfs_subparam=<cfqueryparam cfsqltype="cf_sql_varchar" value="#arguments.subparam#"/>
 		</cfquery>
 		<!--- *** проверить существование - 404 ---> 
 		<cfreturn noData().withStatus(204, "No Content") />