From dd1bae1b00e0ed39381e90e9ce3988d196c82d87 Mon Sep 17 00:00:00 2001 From: Matthias Schmidt Date: Mon, 16 Dec 2013 21:53:12 +0100 Subject: [PATCH] Fixes validation of templateName when copying templates This is relevant when copying a template of an application plugin and naming it the same way as a template of the relevant application which is also in the template group. In this case checking the packageID isn't sufficient since they are different (application <-> application plugin), but the applications also need to be checked. --- .../lib/acp/form/TemplateAddForm.class.php | 22 ++++++++++++------- 1 file changed, 14 insertions(+), 8 deletions(-) diff --git a/wcfsetup/install/files/lib/acp/form/TemplateAddForm.class.php b/wcfsetup/install/files/lib/acp/form/TemplateAddForm.class.php index 40ce50aa59..2e95ad562b 100644 --- a/wcfsetup/install/files/lib/acp/form/TemplateAddForm.class.php +++ b/wcfsetup/install/files/lib/acp/form/TemplateAddForm.class.php @@ -7,6 +7,7 @@ use wcf\data\template\group\TemplateGroupList; use wcf\data\template\Template; use wcf\data\template\TemplateAction; use wcf\form\AbstractForm; +use wcf\system\database\util\PreparedStatementConditionBuilder; use wcf\system\exception\IllegalLinkException; use wcf\system\exception\UserInputException; use wcf\system\WCF; @@ -146,17 +147,22 @@ class TemplateAddForm extends AbstractForm { throw new UserInputException('tplName', 'notValid'); } + $conditionBuilder = new PreparedStatementConditionBuilder(); + $conditionBuilder->add('templateName = ?', array($this->tplName)); + $conditionBuilder->add('templateGroupID = ?', array($this->templateGroupID)); + + if ($this->copiedTemplate !== null) { + $conditionBuilder->add('(packageID = ? OR application = ?)', array($this->packageID, $this->copiedTemplate->application)); + } + else { + $conditionBuilder->add('packageID = ?', array($this->packageID)); + } + $sql = "SELECT COUNT(*) AS count FROM wcf".WCF_N."_template - WHERE templateName = ? - AND packageID = ? - AND templateGroupID = ?"; + ".$conditionBuilder; $statement = WCF::getDB()->prepareStatement($sql); - $statement->execute(array( - $this->tplName, - $this->packageID, - $this->templateGroupID - )); + $statement->execute($conditionBuilder->getParameters()); $row = $statement->fetchArray(); if ($row['count']) { throw new UserInputException('tplName', 'notUnique'); -- 2.20.1