Bugzilla->login();
my $cgi = Bugzilla->cgi;
-my $dbh = Bugzilla->dbh;
my $template = Bugzilla->template;
my $vars = {};
sub validateID
{
my $param = @_ ? $_[0] : 'id';
-
+ my $dbh = Bugzilla->dbh;
+
# If we're not doing interdiffs, check if id wasn't specified and
# prompt them with a page that allows them to choose an attachment.
# Happens when calling plain attachment.cgi from the urlbar directly
|| ThrowUserError("invalid_attach_id", { attach_id => $cgi->param($param) });
# Make sure the attachment exists in the database.
- SendSQL("SELECT bug_id, isprivate FROM attachments WHERE attach_id = $attach_id");
- MoreSQLData()
- || ThrowUserError("invalid_attach_id", { attach_id => $attach_id });
+ my ($bugid, $isprivate) = $dbh->selectrow_array(
+ "SELECT bug_id, isprivate
+ FROM attachments
+ WHERE attach_id = ?",
+ undef, $attach_id);
+ ThrowUserError("invalid_attach_id", { attach_id => $attach_id })
+ unless $bugid;
# Make sure the user is authorized to access this attachment's bug.
- (my $bugid, my $isprivate) = FetchSQLData();
ValidateBugID($bugid);
if ($isprivate && Param("insidergroup")) {
sub validateCanEdit
{
my ($attach_id) = (@_);
-
+ my $dbh = Bugzilla->dbh;
+
# People in editbugs can edit all attachments
return if UserInGroup("editbugs");
# Bug 97729 - the submitter can edit their attachments
- SendSQL("SELECT attach_id FROM attachments WHERE " .
- "attach_id = $attach_id AND submitter_id = " . Bugzilla->user->id);
+ my ($ref) = $dbh->selectrow_array("SELECT attach_id FROM attachments
+ WHERE attach_id = ?
+ AND submitter_id = ?",
+ undef, ($attach_id, Bugzilla->user->id));
- FetchSQLData()
- || ThrowUserError("illegal_attachment_edit",
- { attach_id => $attach_id });
+
+ $ref || ThrowUserError("illegal_attachment_edit",{ attach_id => $attach_id });
}
sub validateCanChangeAttachment
{
my ($attachid) = @_;
- SendSQL("SELECT product_id
+ my $dbh = Bugzilla->dbh;
+ my ($productid) = $dbh->selectrow_array(
+ "SELECT product_id
FROM attachments
INNER JOIN bugs
ON bugs.bug_id = attachments.bug_id
- WHERE attach_id = $attachid");
- my $productid = FetchOneColumn();
+ WHERE attach_id = ?", undef, $attachid);
+
Bugzilla->user->can_edit_product($productid)
|| ThrowUserError("illegal_attachment_edit",
{ attach_id => $attachid });
sub validateCanChangeBug
{
my ($bugid) = @_;
- SendSQL("SELECT product_id
+ my $dbh = Bugzilla->dbh;
+ my ($productid) = $dbh->selectrow_array(
+ "SELECT product_id
FROM bugs
- WHERE bug_id = $bugid");
- my $productid = FetchOneColumn();
+ WHERE bug_id = ?", undef, $bugid);
+
Bugzilla->user->can_edit_product($productid)
|| ThrowUserError("illegal_attachment_edit_bug",
{ bug_id => $bugid });
sub validateObsolete
{
my @obsolete_ids = ();
-
+ my $dbh = Bugzilla->dbh;
+
# Make sure the attachment id is valid and the user has permissions to view
# the bug to which it is attached.
foreach my $attachid ($cgi->param('obsolete')) {
detaint_natural($attachid)
|| ThrowCodeError("invalid_attach_id_to_obsolete", $vars);
- SendSQL("SELECT bug_id, isobsolete, description
- FROM attachments WHERE attach_id = $attachid");
+ my ($bugid, $isobsolete, $description) = $dbh->selectrow_array(
+ "SELECT bug_id, isobsolete, description
+ FROM attachments WHERE attach_id = ?", undef, $attachid);
# Make sure the attachment exists in the database.
- MoreSQLData()
- || ThrowUserError("invalid_attach_id", $vars);
+ ThrowUserError("invalid_attach_id", $vars) unless $bugid;
+
- my ($bugid, $isobsolete, $description) = FetchSQLData();
$vars->{'description'} = $description;
{
# Retrieve and validate parameters
my ($attach_id) = validateID();
-
+ my $dbh = Bugzilla->dbh;
+
# Retrieve the attachment content and its content type from the database.
- SendSQL("SELECT mimetype, filename, thedata FROM attachments " .
+ my ($contenttype, $filename, $thedata) = $dbh->selectrow_array(
+ "SELECT mimetype, filename, thedata FROM attachments " .
"INNER JOIN attach_data ON id = attach_id " .
- "WHERE attach_id = $attach_id");
- my ($contenttype, $filename, $thedata) = FetchSQLData();
+ "WHERE attach_id = ?", undef, $attach_id);
# Bug 111522: allow overriding content-type manually in the posted form
# params.
sub get_unified_diff
{
my ($id) = @_;
-
+ my $dbh = Bugzilla->dbh;
+
# Bring in the modules we need
require PatchReader::Raw;
require PatchReader::FixPatchRoot;
require File::Temp;
# Get the patch
- SendSQL("SELECT bug_id, description, ispatch, thedata " .
+ my ($bugid, $description, $ispatch, $thedata) = $dbh->selectrow_array(
+ "SELECT bug_id, description, ispatch, thedata " .
"FROM attachments " .
"INNER JOIN attach_data " .
"ON id = attach_id " .
- "WHERE attach_id = $id");
- my ($bugid, $description, $ispatch, $thedata) = FetchSQLData();
+ "WHERE attach_id = ?", undef, $id);
if (!$ispatch) {
$vars->{'attach_id'} = $id;
ThrowCodeError("must_be_patch");
my ($attach_id) = validateID();
my $format = validateFormat('html', 'raw');
my $context = validateContext();
-
+ my $dbh = Bugzilla->dbh;
+
# Get patch data
- SendSQL("SELECT bug_id, description, ispatch, thedata FROM attachments " .
+ my ($bugid, $description, $ispatch, $thedata) = $dbh->selectrow_array(
+ "SELECT bug_id, description, ispatch, thedata FROM attachments " .
"INNER JOIN attach_data ON id = attach_id " .
- "WHERE attach_id = $attach_id");
- my ($bugid, $description, $ispatch, $thedata) = FetchSQLData();
+ "WHERE attach_id = ?", undef, $attach_id);
# If it is not a patch, view normally
if (!$ispatch)
# Get list of attachments on this bug.
# Ignore the current patch, but select the one right before it
# chronologically.
- SendSQL("SELECT attach_id, description FROM attachments WHERE bug_id = $bugid AND ispatch = 1 ORDER BY creation_ts DESC");
+ my $sth = $dbh->prepare("SELECT attach_id, description
+ FROM attachments
+ WHERE bug_id = ?
+ AND ispatch = 1
+ ORDER BY creation_ts DESC");
+ $sth->execute($bugid);
my $select_next_patch = 0;
- while (my ($other_id, $other_desc) = FetchSQLData()) {
+ while (my ($other_id, $other_desc) = $sth->fetchrow_array) {
if ($other_id eq $attach_id) {
$select_next_patch = 1;
} else {
if (Param("insidergroup") && !(UserInGroup(Param("insidergroup")))) {
$privacy = "AND isprivate < 1 ";
}
- SendSQL("SELECT attach_id, " .
- $dbh->sql_date_format('creation_ts', '%Y.%m.%d %H:%i') . ",
- mimetype, description, ispatch, isobsolete, isprivate,
- LENGTH(thedata)
+ my $attachments = $dbh->selectall_arrayref(
+ "SELECT attach_id AS attachid, " .
+ $dbh->sql_date_format('creation_ts', '%Y.%m.%d %H:%i') . " AS date,
+ mimetype AS contenttype, description, ispatch, isobsolete, isprivate,
+ LENGTH(thedata) AS datasize
FROM attachments
INNER JOIN attach_data
ON attach_id = id
- WHERE bug_id = $bugid $privacy
- ORDER BY attach_id");
- my @attachments; # the attachments array
- while (MoreSQLData())
+ WHERE bug_id = ? $privacy
+ ORDER BY attach_id", {'Slice'=>{}}, $bugid);
+
+ foreach my $a (@{$attachments})
{
- my %a; # the attachment hash
- ($a{'attachid'}, $a{'date'}, $a{'contenttype'},
- $a{'description'}, $a{'ispatch'}, $a{'isobsolete'}, $a{'isprivate'},
- $a{'datasize'}) = FetchSQLData();
- $a{'isviewable'} = isViewable($a{'contenttype'});
- $a{'flags'} = Bugzilla::Flag::match({ 'attach_id' => $a{'attachid'},
+
+ $a->{'isviewable'} = isViewable($a->{'contenttype'});
+ $a->{'flags'} = Bugzilla::Flag::match({ 'attach_id' => $a->{'attachid'},
'is_active' => 1 });
-
- # Add the hash representing the attachment to the array of attachments.
- push @attachments, \%a;
}
# Retrieve the bug summary (for displaying on screen) and assignee.
- SendSQL("SELECT short_desc, assigned_to FROM bugs " .
- "WHERE bug_id = $bugid");
- my ($bugsummary, $assignee_id) = FetchSQLData();
+ my ($bugsummary, $assignee_id) = $dbh->selectrow_array(
+ "SELECT short_desc, assigned_to FROM bugs " .
+ "WHERE bug_id = ?", undef, $bugid);
# Define the variables and functions that will be passed to the UI template.
$vars->{'bugid'} = $bugid;
- $vars->{'attachments'} = \@attachments;
+ $vars->{'attachments'} = $attachments;
$vars->{'bugassignee_id'} = $assignee_id;
$vars->{'bugsummary'} = $bugsummary;
my $bugid = $cgi->param('bugid');
ValidateBugID($bugid);
validateCanChangeBug($bugid);
-
+ my $dbh = Bugzilla->dbh;
+
# Retrieve the attachments the user can edit from the database and write
# them into an array of hashes where each hash represents one attachment.
my $canEdit = "";
if (!UserInGroup("editbugs")) {
$canEdit = "AND submitter_id = " . Bugzilla->user->id;
}
- SendSQL("SELECT attach_id, description, isprivate
+ my $attachments = $dbh->selectall_arrayref(
+ "SELECT attach_id AS id, description, isprivate
FROM attachments
- WHERE bug_id = $bugid
+ WHERE bug_id = ?
AND isobsolete = 0 $canEdit
- ORDER BY attach_id");
- my @attachments; # the attachments array
- while ( MoreSQLData() ) {
- my %a; # the attachment hash
- ($a{'id'}, $a{'description'}, $a{'isprivate'}) = FetchSQLData();
-
- # Add the hash representing the attachment to the array of attachments.
- push @attachments, \%a;
- }
+ ORDER BY attach_id",{'Slice' =>{}}, $bugid);
# Retrieve the bug summary (for displaying on screen) and assignee.
- SendSQL("SELECT short_desc, assigned_to FROM bugs
- WHERE bug_id = $bugid");
- my ($bugsummary, $assignee_id) = FetchSQLData();
+ my ($bugsummary, $assignee_id) = $dbh->selectrow_array(
+ "SELECT short_desc, assigned_to FROM bugs
+ WHERE bug_id = ?", undef, $bugid);
# Define the variables and functions that will be passed to the UI template.
$vars->{'bugid'} = $bugid;
- $vars->{'attachments'} = \@attachments;
+ $vars->{'attachments'} = $attachments;
$vars->{'bugassignee_id'} = $assignee_id;
$vars->{'bugsummary'} = $bugsummary;
- SendSQL("SELECT product_id, component_id FROM bugs
- WHERE bug_id = $bugid");
- my ($product_id, $component_id) = FetchSQLData();
+ my ($product_id, $component_id)= $dbh->selectrow_array(
+ "SELECT product_id, component_id FROM bugs
+ WHERE bug_id = ?", undef, $bugid);
+
my $flag_types = Bugzilla::FlagType::match({'target_type' => 'attachment',
'product_id' => $product_id,
'component_id' => $component_id});
# Insert a new attachment into the database.
sub insert
{
- my $dbh = Bugzilla->dbh;
my $userid = Bugzilla->user->id;
# Retrieve and validate parameters
my $isurl;
validateIsPatch();
validateDescription();
-
+ my $dbh = Bugzilla->dbh;
+
if (($attachurl =~ /^(http|https|ftp):\/\/\S+/)
&& !(defined $cgi->upload('data'))) {
$filename = '';
$data = $attachurl;
$isurl = 1;
- $contenttype = SqlQuote('text/plain');
+ $contenttype = 'text/plain';
$cgi->param('ispatch', 0);
$cgi->delete('bigfile');
} else {
# we now check the content type for image/bmp in validateData()
validateContentType() unless $cgi->param('ispatch');
$data = validateData();
- $contenttype = SqlQuote($cgi->param('contenttype'));
+ $contenttype = $cgi->param('contenttype');
+
+ # These are inserted using placeholders so no need to panic
+ trick_taint($filename);
+ trick_taint($contenttype);
$isurl = 0;
}
Bugzilla::FlagType::validate($cgi, $bugid, -1);
# Escape characters in strings that will be used in SQL statements.
- my $sql_filename = SqlQuote($filename);
- my $description = SqlQuote($cgi->param('description'));
+ my $description = $cgi->param('description');
+ trick_taint($description);
my $isprivate = $cgi->param('isprivate') ? 1 : 0;
# Figure out when the changes were made.
my ($timestamp) = Bugzilla->dbh->selectrow_array("SELECT NOW()");
- my $sql_timestamp = SqlQuote($timestamp);
-
+
# Insert the attachment into the database.
- my $sth = $dbh->prepare("INSERT INTO attachments
- (bug_id, creation_ts, filename, description,
- mimetype, ispatch, isurl, isprivate, submitter_id)
- VALUES ($bugid, $sql_timestamp, $sql_filename,
- $description, $contenttype, " . $cgi->param('ispatch') . ",
- $isurl, $isprivate, $userid)");
- $sth->execute();
+ my $sth = $dbh->do(
+ "INSERT INTO attachments
+ (bug_id, creation_ts, filename, description,
+ mimetype, ispatch, isurl, isprivate, submitter_id)
+ VALUES (?,?,?,?,?,?,?,?,?)", undef, ($bugid, $timestamp, $filename,
+ $description, $contenttype, $cgi->param('ispatch'),
+ $isurl, $isprivate, $userid));
# Retrieve the ID of the newly created attachment record.
my $attachid = $dbh->bz_last_key('attachments', 'attach_id');
foreach my $obsolete_id (@obsolete_ids) {
# If the obsolete attachment has request flags, cancel them.
# This call must be done before updating the 'attachments' table.
- Bugzilla::Flag::CancelRequests($bugid, $obsolete_id, $sql_timestamp);
+ Bugzilla::Flag::CancelRequests($bugid, $obsolete_id, $dbh->quote($timestamp));
- SendSQL("UPDATE attachments SET isobsolete = 1 " .
- "WHERE attach_id = $obsolete_id");
- SendSQL("INSERT INTO bugs_activity (bug_id, attach_id, who, bug_when,
+ $dbh->do("UPDATE attachments SET isobsolete = 1 " .
+ "WHERE attach_id = ?", undef, $obsolete_id);
+ $dbh->do("INSERT INTO bugs_activity (bug_id, attach_id, who, bug_when,
fieldid, removed, added)
- VALUES ($bugid, $obsolete_id, $userid, $sql_timestamp, $fieldid,
- '0', '1')");
+ VALUES (?,?,?,?,?,?,?)", undef,
+ $bugid, $obsolete_id, $userid, $timestamp, $fieldid, 0, 1);
}
# Assign the bug to the user, if they are allowed to take it
"login_name");
# Get the old values, for the bugs_activity table
- SendSQL("SELECT " . join(", ", @fields) . " " .
+ my @oldvalues = $dbh->selectrow_array(
+ "SELECT " . join(", ", @fields) . " " .
"FROM bugs " .
"INNER JOIN profiles " .
"ON profiles.userid = bugs.assigned_to " .
- "WHERE bugs.bug_id = $bugid");
+ "WHERE bugs.bug_id = ?", undef, $bugid);
- my @oldvalues = FetchSQLData();
my @newvalues = ($userid, "ASSIGNED", "", 1, Bugzilla->user->login);
# Make sure the person we are taking the bug from gets mail.
$owner = $oldvalues[4];
- @oldvalues = map(SqlQuote($_), @oldvalues);
- @newvalues = map(SqlQuote($_), @newvalues);
+ @oldvalues = map($dbh->quote($_), @oldvalues);
+ @newvalues = map($dbh->quote($_), @newvalues);
# Update the bug record. Note that this doesn't involve login_name.
- SendSQL("UPDATE bugs SET delta_ts = $sql_timestamp, " .
+ $dbh->do("UPDATE bugs SET delta_ts = ?, " .
join(", ", map("$fields[$_] = $newvalues[$_]", (0..3))) .
- " WHERE bug_id = $bugid");
-
+ " WHERE bug_id = ?", undef, ($timestamp, $bugid));
+
# If the bug was a dupe, we have to remove its entry from the
# 'duplicates' table.
$dbh->do('DELETE FROM duplicates WHERE dupe = ?', undef, $bugid);
$newvalues[0] = $newvalues[4];
# Add the changes to the bugs_activity table
+ my $sth = $dbh->prepare("INSERT INTO bugs_activity
+ (bug_id, who, bug_when, fieldid, removed, added)
+ VALUES (?,?,?,?,?,?)");
+
for (my $i = 0; $i < 4; $i++) {
if ($oldvalues[$i] ne $newvalues[$i]) {
my $fieldid = get_field_id($fields[$i]);
- SendSQL("INSERT INTO bugs_activity " .
- "(bug_id, who, bug_when, fieldid, removed, added) " .
- "VALUES ($bugid, $userid, $sql_timestamp, " .
- "$fieldid, $oldvalues[$i], $newvalues[$i])");
+ $sth->execute($bugid, $userid, $timestamp,
+ $fieldid, $oldvalues[$i], $newvalues[$i]);
}
}
}
# Users cannot edit the content of the attachment itself.
sub update
{
- my $dbh = Bugzilla->dbh;
my $userid = Bugzilla->user->id;
# Retrieve and validate parameters
validateContentType() unless $cgi->param('ispatch');
validateIsObsolete();
validatePrivate();
+ my $dbh = Bugzilla->dbh;
# The order of these function calls is important, as both Flag::validate
# and FlagType::validate assume User::match_field has ensured that the
# Get a copy of the attachment record before we make changes
# so we can record those changes in the activity table.
- SendSQL("SELECT description, mimetype, filename, ispatch, isobsolete, isprivate
- FROM attachments WHERE attach_id = $attach_id");
my ($olddescription, $oldcontenttype, $oldfilename, $oldispatch,
- $oldisobsolete, $oldisprivate) = FetchSQLData();
+ $oldisobsolete, $oldisprivate) = $dbh->selectrow_array(
+ "SELECT description, mimetype, filename, ispatch, isobsolete, isprivate
+ FROM attachments WHERE attach_id = ?", undef, $attach_id);
# Quote the description and content type for use in the SQL UPDATE statement.
- my $quoteddescription = SqlQuote($cgi->param('description'));
- my $quotedcontenttype = SqlQuote($cgi->param('contenttype'));
- my $quotedfilename = SqlQuote($cgi->param('filename'));
+ my $description = $cgi->param('description');
+ my $contenttype = $cgi->param('contenttype');
+ my $filename = $cgi->param('filename');
+ # we can detaint this way thanks to placeholders
+ trick_taint($description);
+ trick_taint($contenttype);
+ trick_taint($filename);
# Figure out when the changes were made.
- SendSQL("SELECT NOW()");
- my $timestamp = FetchOneColumn();
+ my ($timestamp) = $dbh->selectrow_array("SELECT NOW()");
# Update flags. We have to do this before committing changes
# to attachments so that we can delete pending requests if the user
Bugzilla::Flag::process($bugid, $attach_id, $timestamp, $cgi);
# Update the attachment record in the database.
- SendSQL("UPDATE attachments
- SET description = $quoteddescription ,
- mimetype = $quotedcontenttype ,
- filename = $quotedfilename ,
- ispatch = " . $cgi->param('ispatch') . ",
- isobsolete = " . $cgi->param('isobsolete') . ",
- isprivate = " . $cgi->param('isprivate') . "
- WHERE attach_id = $attach_id
- ");
+ $dbh->do("UPDATE attachments
+ SET description = ?,
+ mimetype = ?,
+ filename = ?,
+ ispatch = ?,
+ isobsolete = ?,
+ isprivate = ?
+ WHERE attach_id = ?",
+ undef, ($description, $contenttype, $filename,
+ $cgi->param('ispatch'), $cgi->param('isobsolete'),
+ $cgi->param('isprivate'), $attach_id));
# Record changes in the activity table.
- my $sql_timestamp = SqlQuote($timestamp);
if ($olddescription ne $cgi->param('description')) {
- my $quotedolddescription = SqlQuote($olddescription);
my $fieldid = get_field_id('attachments.description');
- SendSQL("INSERT INTO bugs_activity (bug_id, attach_id, who, bug_when,
+ $dbh->do("INSERT INTO bugs_activity (bug_id, attach_id, who, bug_when,
fieldid, removed, added)
- VALUES ($bugid, $attach_id, $userid, $sql_timestamp, $fieldid,
- $quotedolddescription, $quoteddescription)");
+ VALUES (?,?,?,?,?,?,?)",
+ undef, ($bugid, $attach_id, $userid, $timestamp, $fieldid,
+ $olddescription, $description));
}
if ($oldcontenttype ne $cgi->param('contenttype')) {
- my $quotedoldcontenttype = SqlQuote($oldcontenttype);
my $fieldid = get_field_id('attachments.mimetype');
- SendSQL("INSERT INTO bugs_activity (bug_id, attach_id, who, bug_when,
+ $dbh->do("INSERT INTO bugs_activity (bug_id, attach_id, who, bug_when,
fieldid, removed, added)
- VALUES ($bugid, $attach_id, $userid, $sql_timestamp, $fieldid,
- $quotedoldcontenttype, $quotedcontenttype)");
+ VALUES (?,?,?,?,?,?,?)",
+ undef, ($bugid, $attach_id, $userid, $timestamp, $fieldid,
+ $oldcontenttype, $contenttype));
}
if ($oldfilename ne $cgi->param('filename')) {
- my $quotedoldfilename = SqlQuote($oldfilename);
my $fieldid = get_field_id('attachments.filename');
- SendSQL("INSERT INTO bugs_activity (bug_id, attach_id, who, bug_when,
+ $dbh->do("INSERT INTO bugs_activity (bug_id, attach_id, who, bug_when,
fieldid, removed, added)
- VALUES ($bugid, $attach_id, $userid, $sql_timestamp, $fieldid,
- $quotedoldfilename, $quotedfilename)");
+ VALUES (?,?,?,?,?,?,?)",
+ undef, ($bugid, $attach_id, $userid, $timestamp, $fieldid,
+ $oldfilename, $filename));
}
if ($oldispatch ne $cgi->param('ispatch')) {
my $fieldid = get_field_id('attachments.ispatch');
- SendSQL("INSERT INTO bugs_activity (bug_id, attach_id, who, bug_when,
+ $dbh->do("INSERT INTO bugs_activity (bug_id, attach_id, who, bug_when,
fieldid, removed, added)
- VALUES ($bugid, $attach_id, $userid, $sql_timestamp, $fieldid,
- $oldispatch, " . $cgi->param('ispatch') . ")");
+ VALUES (?,?,?,?,?,?,?)",
+ undef, ($bugid, $attach_id, $userid, $timestamp, $fieldid,
+ $oldispatch, $cgi->param('ispatch')));
}
if ($oldisobsolete ne $cgi->param('isobsolete')) {
my $fieldid = get_field_id('attachments.isobsolete');
- SendSQL("INSERT INTO bugs_activity (bug_id, attach_id, who, bug_when,
+ $dbh->do("INSERT INTO bugs_activity (bug_id, attach_id, who, bug_when,
fieldid, removed, added)
- VALUES ($bugid, $attach_id, $userid, $sql_timestamp, $fieldid,
- $oldisobsolete, " . $cgi->param('isobsolete') . ")");
+ VALUES (?,?,?,?,?,?,?)",
+ undef, ($bugid, $attach_id, $userid, $timestamp, $fieldid,
+ $oldisobsolete, $cgi->param('isobsolete')));
}
if ($oldisprivate ne $cgi->param('isprivate')) {
my $fieldid = get_field_id('attachments.isprivate');
- SendSQL("INSERT INTO bugs_activity (bug_id, attach_id, who, bug_when,
+ $dbh->do("INSERT INTO bugs_activity (bug_id, attach_id, who, bug_when,
fieldid, removed, added)
- VALUES ($bugid, $attach_id, $userid, $sql_timestamp, $fieldid,
- $oldisprivate, " . $cgi->param('isprivate') . ")");
+ VALUES (?,?,?,?,?,?,?)",
+ undef, ($bugid, $attach_id, $userid, $timestamp, $fieldid,
+ $oldisprivate, $cgi->param('isprivate')));
}
# Unlock all database tables now that we are finished updating the database.
projects / thirdparty / bugzilla.git / commitdiff
