ahtlon/deck
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

fix: Remove bindParam usage with simpler query

Browse Source 
Signed-off-by: Julius Härtl <jus@bitgrid.net>
This commit is contained in:
Julius Härtl
2024-07-02 12:29:10 +02:00
parent 6dfb01fa02
commit 19e35fdee4
1 changed files with 9 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
lib/Db/CardMapper.php
View File

@@ -562,12 +562,15 @@ class CardMapper extends QBMapper implements IPermissionMapper {
}
public function isOwner($userId, $id): bool {
$sql = 'SELECT owner FROM `*PREFIX*deck_boards` WHERE `id` IN (SELECT board_id FROM `*PREFIX*deck_stacks` WHERE id IN (SELECT stack_id FROM `*PREFIX*deck_cards` WHERE id = ?))';
$stmt = $this->db->prepare($sql);
$stmt->bindParam(1, $id, \PDO::PARAM_INT, 0);
$stmt->execute();
$row = $stmt->fetch();
return ($row['owner'] === $userId);
$qb = $this->db->getQueryBuilder();
$qb->select('c.id')
->from($this->getTableName(), 'c')
->innerJoin('c', 'deck_stacks', 's', 'c.stack_id = s.id')
->innerJoin('s', 'deck_boards', 'b', 'b.id = s.board_id')
->where($qb->expr()->eq('c.id', $qb->createNamedParameter($id, IQueryBuilder::PARAM_INT)))
->andWhere($qb->expr()->eq('b.owner', $qb->createNamedParameter($userId, IQueryBuilder::PARAM_STR)));
return count($qb->executeQuery()->fetchAll()) > 0;
}
public function findBoardId($id): ?int {