diff --git a/entity/Comm_entity/conditionProcess.js b/entity/Comm_entity/conditionProcess.js index 6693257607ea56a2f7797af82e53d0829d1d9a97..7ab504b7b04216aec94e4d2dbbcba228e8c50819 100644 --- a/entity/Comm_entity/conditionProcess.js +++ b/entity/Comm_entity/conditionProcess.js @@ -1,27 +1,42 @@ -import("system.text"); -import("system.result"); -import("system.vars"); -import("Sql_lib"); -import("Keyword_lib"); - -var cond, relId, mediumCategories, keywordUtil; - -cond = ""; -if(vars.exists("$param.RelId_param") && (relId = vars.get("$param.RelId_param")) != null){ - cond += " and COMM.RELATION_ID in ('" + relId + "')";//TODO: quoting/prevent sql-injection -} -if (vars.exists("$param.MediumCategoriesFilter_param") && (mediumCategories = vars.get("$param.MediumCategoriesFilter_param")) != null){ - mediumCategories = text.decodeMS(mediumCategories); - keywordUtil = new KeywordUtils(); - var kwd = keywordUtil.createKeyword("COMM.MEDIUM"); - kwd.filter(function(id, name, customs){ - return mediumCategories.indexOf(customs.category) > -1; - }); - mediumIds = kwd.toArray("id"); - if (mediumIds.length == 0) - throw new Error();//TODO: add message - - cond += " and COMM.MEDIUM_ID in (" + mediumIds.join(", ") + ")"; -} - +import("system.logging"); +import("system.text"); +import("system.result"); +import("system.vars"); +import("Sql_lib"); +import("Keyword_lib"); + +var cond, relId, mediumCategories, keywordUtil; + + + +cond = ""; +if(vars.exists("$param.RelId_param")){ + + relId = vars.get("$param.RelId_param"); + + if (relId != null && relId != "" && relId != undefined) + { + cond += " and COMM.RELATION_ID in ('" + relId + "')";//TODO: quoting/prevent sql-injection + } +} +if (vars.exists("$param.MediumCategoriesFilter_param")){ + + mediumCategories = vars.get("$param.MediumCategoriesFilter_param"); + if (mediumCategories != null && mediumCategories != "" && mediumCategories != undefined) + { + + mediumCategories = text.decodeMS(mediumCategories); + keywordUtil = new KeywordUtils(); + var kwd = keywordUtil.createKeyword("COMM.MEDIUM"); + kwd.filter(function(id, name, customs){ + return mediumCategories.indexOf(customs.category) > -1; + }); + mediumIds = kwd.toArray("id"); + if (mediumIds.length == 0) + throw new Error();//TODO: add message + + cond += " and COMM.MEDIUM_ID in (" + mediumIds.join(", ") + ")"; + } +} + result.string(cond ? "1 = 1 " + cond: "1 = 2"); \ No newline at end of file