Not checking if a comment exists before executing the code
Submitted teraßyte, May 18 2012 11:41 AM | Last updated May 18 2012 11:41 AM
In "public_ccs_pages_comments::doExcute()" you load the record data right away but never check if the record actually exists and just go on with the execution:
Also the data in $record is never used until after all the permission checks so you can safely move it above this code below and then check if also the record exists:
Some lines after the code above you then pass the data to the comments class BUT in the extra data there is no 'record' variable to pass $record, you simply use it to load the record category and that's it. Is that intended? I haven't checked further but I believe at some point you'll need to load the record data anyway for the comment so passing it there will probably save an additional query later (unless the query later loads more data from other tables too or loads it in a different way?)
$database = intval($this->request['database']); $record = intval($this->request['record']); $database = $this->caches['ccs_databases'][ $database ]; $record = $this->DB->buildAndFetch( array( 'select' => '*', 'from' => $database['database_database'], 'where' => 'primary_id_field=' . $record ) );
Also the data in $record is never used until after all the permission checks so you can safely move it above this code below and then check if also the record exists:
$databases->categories = $this->registry->ccsFunctions->getCategoriesClass( $databases->database );
Some lines after the code above you then pass the data to the comments class BUT in the extra data there is no 'record' variable to pass $record, you simply use it to load the record category and that's it. Is that intended? I haven't checked further but I believe at some point you'll need to load the record data anyway for the comment so passing it there will probably save an additional query later (unless the query later loads more data from other tables too or loads it in a different way?)
| Status: | Fixed |
| Version: | 2.3.1 |
| Fixed In: | 2.3.2 |
0 Comments