108 bookmark claen fix

v1/Application.cfc

@@ -51,7 +51,7 @@
 		
 		//variables.framework.docs={};
 		variables.framework.docs.APIName="Deck API";
-		variables.framework.docs.APIVersion="0.107"; /*$ git config --global --unset user.password*/
+		variables.framework.docs.APIVersion="0.108"; /*$ git config --global --unset user.password*/
 
 		
 		variables.framework.globalHeaders = structNew();

v1/resources/bookmark.cfc

@@ -81,13 +81,13 @@
 					,descr=<cfqueryparam cfsqltype="cf_sql_varchar" value="#cleanInput(arguments.descr)#"/>		
 				</cfif>				
 				<cfif structKeyExists(arguments,"url")>
-					,url=<cfqueryparam cfsqltype="cf_sql_varchar" value="#cleanInput(arguments.url)#"/>		
+					,url=<cfqueryparam cfsqltype="cf_sql_varchar" value="#arguments.url#"/>		
 				</cfif>				
 				<cfif structKeyExists(arguments,"iconUrl")>
-					,icon_url=<cfqueryparam cfsqltype="cf_sql_varchar" value="#cleanInput(arguments.iconUrl)#"/>		
+					,icon_url=<cfqueryparam cfsqltype="cf_sql_varchar" value="#arguments.iconUrl#"/>		
 				</cfif>				
 				<cfif structKeyExists(arguments,"sort")>
-					,sort=<cfqueryparam cfsqltype="cf_sql_integer" value="#cleanInput(arguments.sort)#"/>		
+					,sort=<cfqueryparam cfsqltype="cf_sql_integer" value="#arguments.sort#"/>		
 				</cfif>				
 				<cfif structKeyExists(arguments,"isEnabled")>
 					,is_enabled=<cfqueryparam cfsqltype="cf_sql_bit" value="#arguments.isEnabled#"/>		

v1/resources/bookmark_ls.cfc

@@ -146,8 +146,8 @@
 					 <cfqueryparam cfsqltype="cf_sql_other" value="#local.bookmarkUid#"/>
 					,<cfqueryparam cfsqltype="cf_sql_integer" value="#arguments.contragentId#"/>
 					,<cfqueryparam cfsqltype="cf_sql_varchar" value="#cleanInput(arguments.bookmark)#"/>
-					,<cfqueryparam cfsqltype="cf_sql_varchar" value="#cleanInput(arguments.url)#"/>
+					,<cfqueryparam cfsqltype="cf_sql_varchar" value="#arguments.url#"/>
-					,<cfqueryparam cfsqltype="cf_sql_varchar" value="#cleanInput(arguments.iconUrl)#"/>
+					,<cfqueryparam cfsqltype="cf_sql_varchar" value="#arguments.iconUrl#"/>
 					,<cfqueryparam cfsqltype="cf_sql_varchar" value="#cleanInput(arguments.descr)#"/>					
 					,<cfqueryparam cfsqltype="cf_sql_integer" value="#arguments.sort#"/>
 					,<cfqueryparam cfsqltype="cf_sql_bit" value="#arguments.isEnabled#" null=#!isValid("boolean",arguments.isEnabled)#/>

v1/resources/instance_operation.cfc

@@ -186,7 +186,7 @@
 				select 
 					 sp.instance_operation_cfs_param_uid::text as instance_operation_cfs_param_uid
 					,sp.instance_operation_cfs_subparam								
-					,sp.descr								
+					,sp.note								
 					,sp.sort
 					,sp.is_sensitive
 				from instance_operation_cfs_subparam sp

v1/resources/instance_operation_cfs_param.cfc

@@ -29,7 +29,7 @@
 				<m:field>iop.instance_operation_uid::text as instance_operation_uid</m:field>
 				<m:field>iop.svc_operation_cfs_param_id</m:field>
 				<!--- <m:field>iop.param_value</m:field> --->
-				<m:field>case when sop.is_sensitive then '********' else iop.param_value end as param_value </m:field>
+				<m:field>case when sop.is_sensitive then '********' else iop.param_value end as param_value </m:field><!--- внимание! если параметр типа MAP, то значение нужно разобрать и замаскировать секреты --->
 				<m:field>iop.note</m:field>
 				<m:field>to_char(iop.dt_created, 'YYYY-MM-DD"T"HH24:MI:SS.FF3TZHTZM') as dt_created</m:field>
 				<m:field>iop.creator_id</m:field>

v1/resources/instance_operation_cfs_subparam.cfc

@@ -161,13 +161,13 @@
 		</cfif>
 		
 		<cfquery name="local.qSave" result="local.result">
-		update instance_operation_cfs_subparam set
+			update instance_operation_cfs_subparam set
-		 dt_updated=<cfqueryparam cfsqltype="cf_sql_timestamp" value="#Now()#" />
+			 dt_updated=<cfqueryparam cfsqltype="cf_sql_timestamp" value="#Now()#" />
-		,updater_id=<cfqueryparam cfsqltype="cf_sql_integer" value="#arguments.usrId#" />
+			,updater_id=<cfqueryparam cfsqltype="cf_sql_integer" value="#arguments.usrId#" />
-		,is_sensitive=<cfqueryparam cfsqltype="cf_sql_bit" value="#arguments.isSensitive#" />	
+			,is_sensitive=<cfqueryparam cfsqltype="cf_sql_bit" value="#arguments.isSensitive#" />	
-		,note=<cfqueryparam cfsqltype="cf_sql_varchar" value="#htmlEditFormat(arguments.note)#" />	<!--- *** XSS!!! --->
+			,note=<cfqueryparam cfsqltype="cf_sql_varchar" value="#htmlEditFormat(arguments.note)#" />	<!--- *** XSS!!! --->
-		where instance_operation_cfs_param_uid=<cfqueryparam cfsqltype="cf_sql_other" value="#arguments.instanceOperationCfsParamUid#" null=#!isValid('guid',arguments.instanceOperationCfsParamUid)#/>
+			where instance_operation_cfs_param_uid=<cfqueryparam cfsqltype="cf_sql_other" value="#arguments.instanceOperationCfsParamUid#" null=#!isValid('guid',arguments.instanceOperationCfsParamUid)#/>
-		AND iop.instance_operation_cfs_subparam=<cfqueryparam cfsqltype="cf_sql_varchar" value="#arguments.subparam#"/>
+			AND iop.instance_operation_cfs_subparam=<cfqueryparam cfsqltype="cf_sql_varchar" value="#arguments.subparam#"/>
 		</cfquery>
 		<!--- *** проверить существование - 404 ---> 
 		<cfreturn noData().withStatus(204, "No Content") />