Changeset 17699

Timestamp:

2008/11/07 17:17:59 (14 years ago)

Author:

takegami

Message:

#394 解決
1.4.9リリース

Location:

branches/version-1

Files:

• data/Smarty/templates/admin/products/review.tpl (modified) (1 diff)
• html/products/detail_image.php (modified) (1 diff)

branches/version-1/data/Smarty/templates/admin/products/review.tpl

@@ -159 +159 @@
     <input type="hidden" name="mode" value="search">
     <input type="hidden" name="review_id" value="">
-    <input type="hidden" name="search_pageno" value="<!--{$tpl_pageno}-->">
+    <input type="hidden" name="search_pageno" value="<!--{$tpl_pageno|escape}-->">
     <!--{foreach key=key item=item from=$arrHidden}-->
     <!--{if $key ne "search_pageno"}-->
-    <input type="hidden" name="<!--{$key}-->" value="<!--{$item}-->" >
+    <input type="hidden" name="<!--{$key}-->" value="<!--{$item|escape}-->" >
     <!--{/if}-->
     <!--{/foreach}-->

branches/version-1/html/products/detail_image.php

@@ -34 +34 @@
 $image_key = $_GET['image'];
 
-$objQuery = new SC_Query();
+
 $col = "name, $image_key";
+if(!sfColumnExists("dtb_products",$_GET['image'])){
+    sfDispSiteError(PRODUCT_NOT_FOUND); 
+}
 $arrRet = $objQuery->select($col, "dtb_products", "product_id = ?", array($_GET['product_id']));