Merge branch 'hotfix/3.1.3.10'

nilsteampassnet · Jan 13, 2025 · aacdf6a · aacdf6a
2 parents b5a9979 + eb95bc3
commit aacdf6a
Show file tree

Hide file tree

Showing 3 changed files with 11 additions and 7 deletions.
diff --git a/includes/config/include.php b/includes/config/include.php
@@ -28,7 +28,7 @@
 
 define('TP_VERSION', '3.1.3');
 define("UPGRADE_MIN_DATE", "1732981987");
-define('TP_VERSION_MINOR', '9');
+define('TP_VERSION_MINOR', '10');
 define('TP_TOOL_NAME', 'Teampass');
 define('TP_ONE_DAY_SECONDS', 86400);
 define('TP_ONE_WEEK_SECONDS', 604800);

diff --git a/install/upgrade_run_3.1.php b/install/upgrade_run_3.1.php
@@ -597,11 +597,15 @@
     "'" => "&#39;"
 ];
 
+$stmt = mysqli_prepare($db_link, 
+    "UPDATE `" . $pre . "tags` 
+    SET `tag` = REPLACE(`tag`, ?, ?)
+    WHERE `tag` LIKE CONCAT('%', ?, '%')");
+
 foreach ($replacements as $search => $replace) {
-    mysqli_query($db_link,
-        "UPDATE `" . $pre. "tags` 
-        SET `tag` = REPLACE(`tag`, '{$search}', '{$replace}')
-        WHERE `tag` LIKE '%{$search}%'");
+    // Link parameters to the prepared statement
+    mysqli_stmt_bind_param($stmt, 'sss', $search, $replace, $search);
+    mysqli_stmt_execute($stmt);
 }
 
 // Remove unused no_bad_attempts field

diff --git a/scripts/task_maintenance_clean_orphan_objects.php b/scripts/task_maintenance_clean_orphan_objects.php
@@ -156,7 +156,7 @@ function cleanOrphanObjects(): void
     DB::query(
         'DELETE l FROM ' . prefixTable('log_system') . ' l
         LEFT JOIN ' . prefixTable('users') . ' u ON l.qui = u.id
-        WHERE i.id IS NULL OR u.deleted_at IS NOT NULL'
+        WHERE u.id IS NULL OR u.deleted_at IS NOT NULL'
     );
 
     // Delete all item keys for which no object exist
@@ -183,7 +183,7 @@ function cleanOrphanObjects(): void
     // Delete all item logs for which no object exist
     DB::query(
         'DELETE l FROM ' . prefixTable('log_items') . ' l
-        LEFT JOIN ' . prefixTable('items') . ' i ON k.id_item = i.id
+        LEFT JOIN ' . prefixTable('items') . ' i ON l.id_item = i.id
         WHERE i.id IS NULL'
     );