Skip to content
Permalink
Browse files Browse the repository at this point in the history
Security fixes
  • Loading branch information
VINADES.,JSC authored and hoaquynhtim99 committed Dec 23, 2019
1 parent b63708f commit 742c0e0
Show file tree
Hide file tree
Showing 2 changed files with 27 additions and 27 deletions.
52 changes: 26 additions & 26 deletions modules/shops/funcs/detail.php
Expand Up @@ -16,9 +16,9 @@
$id_pro = $nv_Request->get_int('id_pro', 'post', 0);
$unit = $nv_Request->get_string('pro_unit', 'post', '');
$listid = $nv_Request->get_string('listid', 'post');
$listid = explode(',', $listid);
$listid = array_map('intval', explode(',', $listid));
asort($listid);

$quantity = $db->query('SELECT quantity FROM ' . $db_config['prefix'] . '_' . $module_data . '_group_quantity WHERE pro_id = ' . $id_pro . ' AND listgroup="' . implode(',', $listid) . '"')->fetchColumn();
if (empty($quantity)) {
$sum = 0;
Expand All @@ -32,7 +32,7 @@
}
}
}

$result = $db->query('SELECT listgroup, quantity FROM ' . $db_config['prefix'] . '_' . $module_data . '_group_quantity WHERE pro_id = ' . $id_pro);
while (list ($listgroup, $quantity) = $result->fetch(3)) {
$listgroup = explode(',', $listgroup);
Expand All @@ -46,7 +46,7 @@
$sum += $quantity;
}
}

if ($sum == 0 or $count == sizeof($listid)) {
die('NO_0_' . $lang_module['product_empty']);
} else {
Expand Down Expand Up @@ -90,14 +90,14 @@
$array_tmp[$row['field']] = unserialize($row['language']);
}
}

if (!empty($listfield)) {
$result = $db->query('SELECT t1.field_value, t2.field FROM ' . $db_config['prefix'] . "_" . $module_data . "_field_value_" . NV_LANG_DATA . ' t1 INNER JOIN ' . $db_config['prefix'] . '_' . $module_data . '_field t2 WHERE t1.field_id=t2.fid AND t1.rows_id=' . $id);
$data_content['template'] = $global_array_shops_cat[$data_content['listcatid']]['form'];
while ($row = $result->fetch()) {
$data_content['array_custom'][$row['field']] = $row['field_value'];
}

if (!empty($array_tmp)) {
foreach ($array_tmp as $f_key => $field) {
foreach ($field as $key_lang => $lang_data) {
Expand All @@ -117,31 +117,31 @@

if (nv_user_in_groups($global_array_shops_cat[$catid]['groups_view'])) {
$popup = $nv_Request->get_int('popup', 'post,get', 0);

$time_set = $nv_Request->get_int($module_data . '_' . $op . '_' . $id, 'session');
if (empty($time_set)) {
$nv_Request->set_Session($module_data . '_' . $op . '_' . $id, NV_CURRENTTIME);
$sql = 'UPDATE ' . $db_config['prefix'] . '_' . $module_data . '_rows SET hitstotal=hitstotal+1 WHERE id=' . $id;
$db->query($sql);
}

$catid = $data_content['listcatid'];
$base_url_rewrite = nv_url_rewrite(NV_BASE_SITEURL . 'index.php?' . NV_LANG_VARIABLE . '=' . NV_LANG_DATA . '&' . NV_NAME_VARIABLE . '=' . $module_name . '&' . NV_OP_VARIABLE . '=' . $global_array_shops_cat[$catid]['alias'] . '/' . $data_content[NV_LANG_DATA . '_alias'] . $global_config['rewrite_exturl'], true);

if ($_SERVER['REQUEST_URI'] != $base_url_rewrite and !$popup) {
Header('Location: ' . $base_url_rewrite);
die();
}

// Lay don vi san pham
$sql = $db->query('SELECT * FROM ' . $db_config['prefix'] . '_' . $module_data . '_units WHERE id = ' . $data_content['product_unit']);
$data_unit = $sql->fetch();
$data_unit['title'] = $data_unit[NV_LANG_DATA . '_title'];

// Hien thi tabs
$sql = 'SELECT * FROM ' . $db_config['prefix'] . '_' . $module_data . '_tabs where active=1 ORDER BY weight ASC';
$data_content['tabs'] = $nv_Cache->db($sql, 'id', $module_name);

$data_content['files'] = array();
if (!empty($data_content['tabs'])) {
// Download tai lieu san pham
Expand All @@ -153,7 +153,7 @@
}
}
}

// Danh gia - Phan hoi
$rating_total = 0;
$result = $db->query('SELECT rating FROM ' . $db_config['prefix'] . '_' . $module_data . '_review WHERE product_id = ' . $data_content['id'] . ' AND status=1');
Expand All @@ -166,7 +166,7 @@
$data_content['rating_total'] = $rating_count;
$data_content['rating_point'] = $rating_total;
$data_content['rating_value'] = $rating_count > 0 ? round($rating_total / $rating_count) : 0;

// Xac dinh anh lon
$homeimgfile = $data_content['homeimgfile'];
if ($data_content['homeimgthumb'] == 1) {
Expand All @@ -183,7 +183,7 @@
// no image
$data_content['homeimgthumb'] = NV_BASE_SITEURL . 'themes/' . $module_info['template'] . '/images/' . $module_file . '/no-image.jpg';
}

// Tu khoa
$array_keyword = array();
$key_words = array();
Expand All @@ -193,10 +193,10 @@
$key_words[] = $row['keyword'];
}
$key_words = !empty($key_words) ? implode(',', $key_words) : '';

// metatag image facebook
$meta_property['og:image'] = NV_MY_DOMAIN . $data_content['homeimgfile'];

// Fetch Limit
$db->sqlreset()
->select(' id, listcatid, ' . NV_LANG_DATA . '_title, ' . NV_LANG_DATA . '_alias, homeimgfile, homeimgthumb, addtime, publtime, product_code, product_number, product_price, price_config, money_unit, discount_id, showprice, ' . NV_LANG_DATA . '_hometext,' . NV_LANG_DATA . '_gift_content, gift_from, gift_to')
Expand All @@ -205,7 +205,7 @@
->order('ID DESC')
->limit($pro_config['per_row'] * 2);
$result = $db->query($db->sql());

$data_others = array();
while (list ($_id, $listcatid, $title, $alias, $homeimgfile, $homeimgthumb, $addtime, $publtime, $product_code, $product_number, $product_price, $price_config, $money_unit, $discount_id, $showprice, $hometext, $gift_content, $gift_from, $gift_to) = $result->fetch(3)) {
if ($homeimgthumb == 1) {
Expand All @@ -221,7 +221,7 @@
// no image
$thumb = NV_BASE_SITEURL . 'themes/' . $module_info['template'] . '/images/' . $module_file . '/no-image.jpg';
}

$data_others[] = array(
'id' => $_id,
'listcatid' => $listcatid,
Expand All @@ -246,7 +246,7 @@
'link_order' => NV_BASE_SITEURL . 'index.php?' . NV_LANG_VARIABLE . '=' . NV_LANG_DATA . '&' . NV_NAME_VARIABLE . '=' . $module_name . '&' . NV_OP_VARIABLE . '=setcart&id=' . $_id
);
}

$array_other_view = array();
if (!empty($_SESSION[$module_data . '_proview'])) {
$arrid = array();
Expand Down Expand Up @@ -279,7 +279,7 @@
// no image
$thumb = NV_BASE_SITEURL . 'themes/' . $module_info['template'] . '/images/' . $module_file . '/no-image.jpg';
}

$array_other_view[] = array(
'id' => $_id,
'listcatid' => $listcatid,
Expand All @@ -305,9 +305,9 @@
}
}
}

SetSessionProView($data_content['id'], $data_content[NV_LANG_DATA . '_title'], $data_content[NV_LANG_DATA . '_alias'], $data_content['addtime'], NV_BASE_SITEURL . 'index.php?' . NV_LANG_VARIABLE . '=' . NV_LANG_DATA . '&' . NV_NAME_VARIABLE . '=' . $module_name . '&' . NV_OP_VARIABLE . '=' . $global_array_shops_cat[$catid]['alias'] . '/' . $data_content[NV_LANG_DATA . '_alias'] . '-' . $data_content['id'], $data_content['homeimgthumb']);

// comment
if (isset($site_mods['comment']) and isset($module_config[$module_name]['activecomm'])) {
define('NV_COMM_ID', $data_content['id']); // ID bài viết hoặc
Expand All @@ -321,12 +321,12 @@
require_once NV_ROOTDIR . '/modules/comment/comment.php';
$area = (defined('NV_COMM_AREA')) ? NV_COMM_AREA : 0;
$checkss = md5($module_name . '-' . $area . '-' . NV_COMM_ID . '-' . $allowed . '-' . NV_CACHE_PREFIX);

$content_comment = nv_comment_module($module_name, $checkss, $area, NV_COMM_ID, $allowed, 1);
} else {
$content_comment = '';
}

$contents = detail_product($data_content, $data_unit, $data_others, $array_other_view, $content_comment, $compare_id, $popup, $idtemplate, $array_keyword);
} else {
$nv_redirect = NV_BASE_SITEURL . 'index.php?' . NV_LANG_VARIABLE . '=' . NV_LANG_DATA . '&' . NV_NAME_VARIABLE . '=' . $module_name;
Expand All @@ -339,4 +339,4 @@
include NV_ROOTDIR . '/includes/header.php';
echo nv_site_theme($contents);
include NV_ROOTDIR . '/includes/footer.php';
}
}
2 changes: 1 addition & 1 deletion modules/shops/funcs/search_result.php
Expand Up @@ -38,7 +38,7 @@
if (!empty($group_price)) {
$search .= " AND";
foreach ($group_price as $i => $group_price_i) {
$group_price_i = explode('-', $group_price_i);
$group_price_i = array_map('intval', explode('-', $group_price_i));
if ($group_price_i[0] <= $group_price_i[1]) {
$search .= ($i > 0 ? " OR " : "") . " product_price BETWEEN " . $group_price_i[0] . " AND " . $group_price_i[1] . " ";
} else {
Expand Down

0 comments on commit 742c0e0

Please sign in to comment.