From: Roland Mas <lolando@debian.org>
Date: Fri, 19 Mar 2010 15:33:38 +0000 (+0000)
Subject: SQL syntax fix
X-Git-Tag: v5_0~32
X-Git-Url: https://scm.fusionforge.org/anonscm/gitweb?p=fusionforge%2Ffusionforge.git;a=commitdiff_plain;h=f6582aed33087da103d630fe2660aafb0b4e30a3

SQL syntax fix
---

diff --git a/gforge/www/tracker/mod.php b/gforge/www/tracker/mod.php
index 8d13b75ed0..34a1ab8769 100644
--- a/gforge/www/tracker/mod.php
+++ b/gforge/www/tracker/mod.php
@@ -94,30 +94,22 @@ if (session_loggedin()) {
 //
 	$perm =& $group->getPermission(session_get_user());
 	if ($perm->isArtifactAdmin()) {
-		$res = db_query_params ('SELECT agl.group_artifact_id, agl.name
-			FROM artifact_group_list agl, role_setting rs, user_group ug
-			WHERE agl.group_artifact_id=rs.ref_id
-			AND ug.user_id=$1
-			AND rs.value IN (0, 1, 2)
-			AND agl.group_id=$2
-			AND ug.role_id = rs.role_id
-			AND rs.section_name=$3',
-				array(user_getid() ,
-				      $group_id,
-				      'tracker'));
+		$rsv = db_int_array_to_any_clause (array (0, 1, 2)) ;
 	} else {
-		$res = db_query_params ('SELECT agl.group_artifact_id, agl.name
+		$rsv = db_int_array_to_any_clause (array (1, 2)) ;
+	}
+	$res = db_query_params ('SELECT agl.group_artifact_id, agl.name
 			FROM artifact_group_list agl, role_setting rs, user_group ug
 			WHERE agl.group_artifact_id=rs.ref_id
 			AND ug.user_id=$1
-			AND rs.value IN (1, 2)
-			AND agl.group_id=$2
+			AND rs.value = ANY ($2)
+			AND agl.group_id=$3
 			AND ug.role_id = rs.role_id
-			AND rs.section_name=$3',
-				array(user_getid() ,
+			AND rs.section_name=$4',
+				array(user_getid(),
+				      $rsv,
 				      $group_id,
 				      'tracker'));
-	}
 
 	echo html_build_select_box ($res,'new_artifact_type_id',$ath->getID(),false);