diff --git a/application/libraries/Save.php b/application/libraries/Save.php index b3b01b4668c..d107779686c 100644 --- a/application/libraries/Save.php +++ b/application/libraries/Save.php @@ -281,7 +281,7 @@ function set_answer_time() $setField = $_POST['lastanswer']; } elseif (isset($_POST['lastgroup'])) - { + { $setField = $_POST['lastgroup']; } $passedTime = round(microtime(true) - $_POST['start_time'],2); @@ -293,7 +293,9 @@ function set_answer_time() } else { + $aColumnNames=Survey_timings::model($thissurvey['sid'])->getTableSchema()->columnNames; $setField .= "time"; + if (!in_array($setField,$aColumnNames)) die('Invalid last group timing fieldname'); $setField = Yii::app()->db->quoteColumnName($setField); $query = "UPDATE {{survey_{$thissurvey['sid']}_timings}} SET " ."interviewtime = (CASE WHEN interviewtime IS NULL THEN 0 ELSE interviewtime END) + " .$passedTime .","