クォートが含まれるオプションが保存されない問題を修正

git-svn-id: https://svn.sourceforge.jp/svnroot/nucleus-jp/plugin@449 1ca29b6e-896d-4ea0-84a5-967f57386b96

diff --git a/trunk/NP_RetainOptions/NP_RetainOptions.php b/trunk/NP_RetainOptions/NP_RetainOptions.php
index 8576f22..c622e5b 100644 (file)
--- a/trunk/NP_RetainOptions/NP_RetainOptions.php
+++ b/trunk/NP_RetainOptions/NP_RetainOptions.php
@@ -1,12 +1,13 @@
 <?php
 
+define('NP_RETAIN_OPTIONS_LIFETIME', 86400);
 
 class NP_RetainOptions extends NucleusPlugin {
 
  function getNAME() { return 'Retain Options';  }
  function getAuthor()  { return 'Andy';  }
  function getURL() {  return ''; }
- function getVersion() { return '0.5'; }
+ function getVersion() { return '0.6'; }
  function getDescription() { 
   return 'Retain plugin options while you update(uninstall and reinstall) plugins. Keep up to one day';
  }
@@ -59,30 +60,30 @@ class NP_RetainOptions extends NucleusPlugin {
        function event_PreDeletePlugin(&$data) {
                if ($this->getOption('disable') == 'yes') return;
                $plugid = $data['plugid'];
-               $result = sql_query('SELECT pfile FROM '.sql_table('plugin'). ' WHERE pid='.$plugid);
+               $result = sql_query('SELECT pfile FROM '.sql_table('plugin'). ' WHERE pid='.intval($plugid));
                $plugin = mysql_fetch_array($result);
                $pname = strtolower($plugin['pfile']);
                mysql_free_result($result);
                if ($pname == get_class($this)) return; // don't retain this plugin
                $currenttime = mysqldate(time());
                sql_query('INSERT INTO '.sql_table('plug_retainoptions_plugin')
-                               . " (pluginname, storetime) VALUES ('$pname', $currenttime)");
+                               . " (pluginname, storetime) VALUES ('" . mysql_real_escape_string($pname) . "', " . intval($currenttime) . ")");
                $id = mysql_insert_id();
                $descs = sql_query('SELECT oid, oname, ocontext FROM '.sql_table('plugin_option_desc')
-                                               . ' WHERE opid='.$plugid);
+                                               . ' WHERE opid='.intval($plugid));
                while ($desc = mysql_fetch_array($descs)) {
                        sql_query('INSERT INTO '.sql_table('plug_retainoptions_options'). ' SET '
-                                       . "id=$id"
-                                       . ', optionname="'.$desc['oname'].'"'
-                                       . ', optioncontext="'.$desc['ocontext'].'"');
+                                       . "id=" . intval($id)
+                                       . ", optionname='".mysql_real_escape_string($desc['oname'])."'"
+                                       . ", optioncontext='".mysql_real_escape_string($desc['ocontext'])."'");
                        $optionid = mysql_insert_id();
                        $options = sql_query('SELECT ovalue, ocontextid FROM '.sql_table('plugin_option')
                                                          . ' WHERE oid='.$desc['oid']);
                        while ($option = mysql_fetch_array($options)) {
                                sql_query('INSERT INTO '.sql_table('plug_retainoptions'). ' SET '
-                                               . "optionid=$optionid"
-                                               . ', contextid='.$option['ocontextid']
-                                               . ', optionvalue="'.$option['ovalue'].'"');
+                                               . "optionid=". intval($optionid)
+                                               . ', contextid='.intval($option['ocontextid'])
+                                               . ", optionvalue='".mysql_real_escape_string($option['ovalue'])."'");
                        }
                        mysql_free_result($options);
                }
@@ -93,9 +94,9 @@ class NP_RetainOptions extends NucleusPlugin {
                if ($this->getOption('disable') == 'yes') return;
                $plugin = & $data['plugin'];
                $pname = get_class($plugin);
-               $oldesttimestamp = mysqldate(time() - 24*60*60);
+               $oldesttimestamp = mysqldate(time() - NP_RETAIN_OPTIONS_LIFETIME);
                $result = sql_query('SELECT id FROM '.sql_table('plug_retainoptions_plugin')
-                                                       ." WHERE pluginname='$pname' AND STORETIME>=$oldesttimestamp");
+                                                       ." WHERE pluginname='". mysql_real_escape_string($pname) . "' AND STORETIME>=". intval($oldesttimestamp));
                $nums = mysql_num_rows($result);
                if (!$nums) { $this->cleanup(); return; }
                while ($nums--) $row = mysql_fetch_array($result);
@@ -103,20 +104,19 @@ class NP_RetainOptions extends NucleusPlugin {
                $id = $row['id'];
                $options = sql_query('SELECT optionid, optionname, optioncontext FROM '
                                                        . sql_table('plug_retainoptions_options')
-                                                       . " WHERE id=$id");
+                                                       . " WHERE id=".intval($id));
                while ($option = mysql_fetch_array($options)) {
                        $optionname = $option['optionname'];
                        $contextname = $option['optioncontext'];
                        $odescs = sql_query('SELECT oid FROM '.sql_table('plugin_option_desc')
-                                               . ' WHERE opid='.$plugin->plugid
-                                               . ' AND oname="'.$optionname.'"'
-
-                                               . ' AND ocontext="'.$contextname.'"');
+                                               . ' WHERE opid='.intval($plugin->plugid)
+                                               . " AND oname='".mysql_real_escape_string($optionname)."'"
+                                               . " AND ocontext='".mysql_real_escape_string($contextname)."'");
                        // restore values only when option name and option context are same
                        if ($odesc = mysql_fetch_array($odescs)) {
                                $values = sql_query('SELECT contextid, optionvalue FROM '
                                                                . sql_table('plug_retainoptions')
-                                                               . ' WHERE optionid='.$option['optionid']);
+                                                               . ' WHERE optionid='.intval($option['optionid']));
                                while ($value = mysql_fetch_array($values)) {
                                        // call plugin function instead of directly store in DB
                                        // because some items/blogs/categories might not exist
@@ -132,24 +132,24 @@ class NP_RetainOptions extends NucleusPlugin {
        }
 
        function cleanup() {
-               $oldesttimestamp = time() - 24*60*60;
+               $oldesttimestamp = time() - NP_RETAIN_OPTIONS_LIFETIME;
                $result = sql_query('SELECT id FROM '.sql_table('plug_retainoptions_plugin')
-                                                       ." WHERE STORETIME<$oldesttimestamp");
+                                                       ." WHERE STORETIME < " . intval($oldesttimestamp));
                while ($row = mysql_fetch_array($result)) {
                        $options = sql_query('SELECT optionid FROM '
                                                                . sql_table('plug_retainoptions_options')
-                                                               . ' WHERE id='.$row['id']);
+                                                               . ' WHERE id='.intval($row['id']));
                        while ($option = mysql_fetch_array($options)) {
                                sql_query('DELETE FROM '.sql_table('plug_retainoptions')
-                                               . ' WHERE optionid='.$option['optionid']);
+                                               . ' WHERE optionid='.intval($option['optionid']));
                        }
                        mysql_free_result($options);
                        sql_query('DELETE FROM '. sql_table('plug_retainoptions_options')
-                                       . ' WHERE id='.$row['id']);
+                                       . ' WHERE id='.intval($row['id']));
                }
                mysql_free_result($result);
                sql_query('DELETE FROM '.sql_table('plug_retainoptions_plugin')
-                               ." WHERE STORETIME<$oldesttimestamp");
+                               ." WHERE STORETIME < " . intval($oldesttimestamp));
        }
 
 }