copenhagentruckwash/api
1
0
Fork 0
Code Issues Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

Fix SQL injection concerns: use prepared statements in orderItemsRoute and tests

Browse Source
This commit is contained in:
copilot-swe-agent[bot]
2026-07-06 23:14:34 +00:00
committed by GitHub
parent 53d0636193
commit 1d25cbe21c
2 changed files with 22 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/nginx/app/tests/Api/LimitedBackofficeApiTest.php
+12 -6
View File
@@ -1727,10 +1727,13 @@ it('assigns list_notifications and list_own_notifications to managed employees',
expect($managedGroupId)->toBeGreaterThan(0);
foreach (['list_notifications', 'list_own_notifications'] as $perm) {
$permRow = api_test_runtime()->queryOne(
'SELECT 1 FROM `groups_permissions`
WHERE `group_id` = ' . $managedGroupId . " AND `permission` = '" . $perm . "' LIMIT 1"
$stmt = api_test_runtime()->db()->prepare(
'SELECT 1 FROM `groups_permissions` WHERE `group_id` = ? AND `permission` = ? LIMIT 1'
);
$stmt->bind_param('is', $managedGroupId, $perm);
$stmt->execute();
$permRow = $stmt->get_result()->fetch_assoc();
$stmt->close();
expect($permRow)->not->toBeNull("Managed employee must have $perm permission");
}
});
@@ -1760,10 +1763,13 @@ it('assigns statistics permissions (Overblik) to all active limited backoffice r
expect($managedGroupId)->toBeGreaterThan(0);
foreach (['statistics_orders_new', 'statistics_bookings_new'] as $perm) {
$permRow = api_test_runtime()->queryOne(
'SELECT 1 FROM `groups_permissions`
WHERE `group_id` = ' . $managedGroupId . " AND `permission` = '" . $perm . "' LIMIT 1"
$stmt = api_test_runtime()->db()->prepare(
'SELECT 1 FROM `groups_permissions` WHERE `group_id` = ? AND `permission` = ? LIMIT 1'
);
$stmt->bind_param('is', $managedGroupId, $perm);
$stmt->execute();
$permRow = $stmt->get_result()->fetch_assoc();
$stmt->close();
expect($permRow)->not->toBeNull("$roleKey managed employee must have $perm permission");
}
}