Skip to content

Commit

Permalink
Fix SQL query quoting/casting when type is passed to where function
Browse files Browse the repository at this point in the history
The $type variable can be both string or int, so before comparing it to
'TYPE_CONDITION' string it has to be casted to avoid comparing integer zero
with string (0 == 'TYPE_CONDITION') which will wrongly return true,
and remove the information about type.

Pass type provided to where function down the chain to allow automatic
casting of arrays of values e.g. to int.

This fixes following cases:
1)
->where('attr_table.store_id IN (?)', $storeIds, Zend_Db::INT_TYPE);
2)
->where('attr_table.store_id = ?', $storeId, Zend_Db::INT_TYPE);
In both cases now passed value is correctly casted to int
(either single value, or each value from array)

Co-authored-by: Ihor Sviziev <[email protected]>
  • Loading branch information
tmotyl and ihor-sviziev committed Jun 3, 2020
1 parent 39012d4 commit 0118d48
Show file tree
Hide file tree
Showing 2 changed files with 10 additions and 8 deletions.
7 changes: 4 additions & 3 deletions lib/internal/Magento/Framework/DB/Adapter/Pdo/Mysql.php
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,7 @@
use Magento\Framework\DB\Query\Generator as QueryGenerator;
use Magento\Framework\DB\Select;
use Magento\Framework\DB\SelectFactory;
use Magento\Framework\DB\Sql\Expression;
use Magento\Framework\DB\Statement\Parameter;
use Magento\Framework\Exception\LocalizedException;
use Magento\Framework\Phrase;
Expand Down Expand Up @@ -1511,10 +1512,10 @@ public function select()
* Method revrited for handle empty arrays in value param
*
* @param string $text The text with a placeholder.
* @param mixed $value The value to quote.
* @param string $type OPTIONAL SQL datatype
* @param array|null|int|string|float|Expression|Select|\DateTimeInterface $value The value to quote.
* @param int|string|null $type OPTIONAL SQL datatype of the given value e.g. Zend_Db::FLOAT_TYPE or "INT"
* @param integer $count OPTIONAL count of placeholders to replace
* @return string An SQL-safe quoted value placed into the orignal text.
* @return string An SQL-safe quoted value placed into the original text.
*/
public function quoteInto($text, $value, $type = null, $count = null)
{
Expand Down
11 changes: 6 additions & 5 deletions lib/internal/Magento/Framework/DB/Select.php
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@

use Magento\Framework\App\ResourceConnection;
use Magento\Framework\DB\Adapter\AdapterInterface;
use Magento\Framework\DB\Sql\Expression;

/**
* Class for SQL SELECT generation and results.
Expand Down Expand Up @@ -107,19 +108,19 @@ public function __construct(
* </code>
*
* @param string $cond The WHERE condition.
* @param string|array|null $value OPTIONAL An optional single or array value to quote into the condition.
* @param string|int|null $type OPTIONAL The type of the given value
* @return \Magento\Framework\DB\Select
* @param array|null|int|string|float|Expression|Select|\DateTimeInterface $value The value to quote.
* @param int|string|null $type OPTIONAL SQL datatype of the given value e.g. Zend_Db::FLOAT_TYPE or "INT"
* @return Select
*/
public function where($cond, $value = null, $type = null)
{
if ($value === null && $type === null) {
$value = '';
} elseif ($type == self::TYPE_CONDITION) {
} elseif ((string)$type === self::TYPE_CONDITION) {
$type = null;
}
if (is_array($value)) {
$cond = $this->getConnection()->quoteInto($cond, $value);
$cond = $this->getConnection()->quoteInto($cond, $value, $type);
$value = null;
}
return parent::where($cond, $value, $type);
Expand Down

0 comments on commit 0118d48

Please sign in to comment.