Warning! Potential security vulnerability and data loss.

[jancha]

addons/mvc/lib/Model/Table.php

we have method there
function dsql($instance=null,$select_mode=true,$entity_code=null)

if one wants to use $model->dsql() and then perform non-select
operation (e.g. do_delete()), false should be set as first param, as else tables are appended with table aliases and thus create illegal sql query.

$dq = $model->dsql(null, false);

now, if you previously in the model initialisation had used

$this->setMasterField($field, $value) //e.g. "user", "1"

and then if you have a method, which is performing cleanup in following
way:

$dq->do_delete(); //assuming, that setMasterField is there

then you will have delete operation performed WITHOUT master field conditions.

if $select_mode is set to false, then conditions to dsql are not
applied. thus do_delete would clean up all records in the db :)

this is what happened in the test environment in gradpool. so not big
deal, but just be informed that setMasterField is dangerous!!!

potential solution:

1. add new method
   function applyMasterConditions($dq){
   if ($this->init_where){
   foreach ($this->init_where as $k => $v){
   $dq->where($k, $v);
   }
   }
   return $dq;
   }
2. if you are using $model->dsql(null, false), then either inside function new_dsql() automate execution of applyMasterConditions, or add to manual to execute this manually. Obviously, if we have "Secure by default", this should happen automatically.

[romaninsh]

closing this down because it's too outdated and only applies to 4.1.x and was fixed in 4.2.0