Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Ignore this ... #1098

Closed
wants to merge 132 commits into from
Closed

Conversation

DavidGoodwin
Copy link

  • Add github action
  • Support PHP 8.1 and higher
  • Get unit tests passing

romantymoshyk and others added 30 commits July 7, 2015 19:08
Especially the doc blocks should now be much better than before.
Especially doc blocks should be much cleaner.
Added `$comparison` as second argument to the `filterByPrimaryKey` methods of the generated query classes.
Fixes this installation error:

    PEAR repository from http://pear.php.net could not be loaded. Your configuration does not allow connections to http://pear.php.net/channel.xml. See https://getcomposer.org/doc/06-config.md#secure-http for details.
This avoids having to download it separately, especially since the tests only work with PHPUnit < 6
`$buildScopeVars` is initialized as a string but later appended to as an array via `$buildScopeVars[] = …`. This throws a fatal error in some versions of PHP.

The fix was to re-initialize it to an array before appending values.
This prevents SQL injection via limit() and is a similar fix as the one added to Propel2 [1]. See that pull request for details.

[1] propelorm/Propel2#1465
When constructing a MySQL LIMIT clause, values for the offset and limit are coerced to integers. This prevents arbitrary SQL from being injected via a query limit. Example:

    UserQuery::create()->limit('1;DROP TABLE users')->find();

Previously, this would have injected `DROP TABLE users` into the generated SQL. Now, the limit value would be coerced to the integer `1`.

This is similar to the fix for Propel2 [1].

Fixes propelorm#1052

[1] propelorm/Propel2#1464
@DavidGoodwin DavidGoodwin changed the title Support PHP 8.1 + Ignore this ... Support PHP 8.1 + Jun 1, 2023
@DavidGoodwin DavidGoodwin changed the title Ignore this ... Support PHP 8.1 + Ignore this ... Jun 1, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

7 participants