Changeset 13457 for trunk/administration

Timestamp:

12/17/09 09:21:42 (2 years ago)

Author:

Alexander Ermashev

Message:

• ticket #1613;

File:

• trunk/administration/email_templates.php (modified) (4 diffs)

trunk/administration/email_templates.php

@@ -39 +39 @@
     $mixedResultSettings = $oSettings->saveChanges($_POST);
 } elseif(isset($_POST['action']) && $_POST['action'] == 'get_translations') {
-    $aTranslation = $GLOBALS['MySQL']->getRow("SELECT `Subject` AS `subject`, `Body` AS `body` FROM `sys_email_templates` WHERE `Name`='" . $_POST['templ_name'] . "' AND `LangID`='" . (int)$_POST['lang_id'] . "' LIMIT 1");
+    $aTranslation = $GLOBALS['MySQL']->getRow("SELECT `Subject` AS `subject`, `Body` AS `body` FROM `sys_email_templates` WHERE `Name`='" . process_db_input($_POST['templ_name']) . "' AND `LangID`='" . (int)$_POST['lang_id'] . "' LIMIT 1");
     if(empty($aTranslation))
-        $aTranslation = $GLOBALS['MySQL']->getRow("SELECT `Subject` AS `subject`, `Body` AS `body` FROM `sys_email_templates` WHERE `Name`='" . $_POST['templ_name'] . "' AND `LangID`='0' LIMIT 1");
+        $aTranslation = $GLOBALS['MySQL']->getRow("SELECT `Subject` AS `subject`, `Body` AS `body` FROM `sys_email_templates` WHERE `Name`='" . process_db_input($_POST['templ_name']) . "' AND `LangID`='0' LIMIT 1");
         
     $oJson = new Services_JSON();   
@@ -63 +63 @@
 
 function PageCodeSettings($mixedResult) {
+
     $sResult = $GLOBALS['oAdmTemplate']->parseHtmlByName('design_box_content.html', array('content' => $GLOBALS['oSettings']->getForm()));    
     if($mixedResult !== true && !empty($mixedResult))
@@ -70 +71 @@
 }
 function PageCodeTemplates($mixedResult) {
+
     $aForm = array(
         'form_attrs' => array(
@@ -158 +160 @@
         $iResult = 0;
         foreach($aEmails as $aEmail) {
-            $iEmailId = (int)$GLOBALS['MySQL']->getOne("SELECT `ID` FROM `sys_email_templates` WHERE `Name`='" . $aEmail['name'] . "' AND `LangID`='" . (int)$_POST[$aEmail['name'] . '_Language'] . "' LIMIT 1");
+            $iEmailId = (int)$GLOBALS['MySQL']->getOne("SELECT `ID` FROM `sys_email_templates` WHERE `Name`='" . process_db_input($aEmail['name']) . "' AND `LangID`='" . (int)$_POST[$aEmail['name'] . '_Language'] . "' LIMIT 1");
             if($iEmailId != 0)
-                $iResult += (int)$GLOBALS['MySQL']->query("UPDATE `sys_email_templates` SET `Subject`='" . $_POST[$aEmail['name'] . '_Subject'] . "', `Body`='" . $_POST[$aEmail['name'] . '_Body'] . "' WHERE `ID`='" . $iEmailId . "'");
+                $iResult += (int)$GLOBALS['MySQL']->query("UPDATE `sys_email_templates` SET `Subject`='" . process_db_input($_POST[$aEmail['name'] . '_Subject']) . "', `Body`='" . process_db_input($_POST[$aEmail['name'] . '_Body']) . "' WHERE `ID`='" . $iEmailId . "'");
             else
-                $iResult += (int)$GLOBALS['MySQL']->query("INSERT INTO `sys_email_templates` SET `Name`='" . $aEmail['name'] . "', `Subject`='" . $_POST[$aEmail['name'] . '_Subject'] . "', `Body`='" . $_POST[$aEmail['name'] . '_Body'] . "', `LangID`='" . (int)$_POST[$aEmail['name'] . '_Language'] . "'");
+                $iResult += (int)$GLOBALS['MySQL']->query("INSERT INTO `sys_email_templates` SET `Name`='" . process_db_input($aEmail['name']) . "', `Subject`='" . process_db_input($_POST[$aEmail['name'] . '_Subject']) . "', `Body`='" . process_db_input($_POST[$aEmail['name'] . '_Body']) . "', `LangID`='" . (int)$_POST[$aEmail['name'] . '_Language'] . "'");
         }