Skip to content

Commit

Permalink
Fix sanity check in resource/create controller (#16477)
Browse files Browse the repository at this point in the history
### What does it do?
Add sanity check for $userGroups in XPDO query during creating a new
resource.

### Why is it needed?
In the case the user is a sudo user and isn't assigned to any groups,
the $userGroups which is a reflection of the user assigned groups can be
empty. This cause a SQL error during creating a new resource.

```
Array
(
    [0] => 42000
    [1] => 1064
    [2] => You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ') OR  ( `ProfileUserGroup`.`usergroup` IS NULL AND `UGProfile`.`active` = 1 )  )' at line 1
)
```

### How to test

1. Login in the manager with only sudo rights.
2. Create a new resource
3. See error log for the SQL error.

### Related issue(s)/PR(s)
#16376
  • Loading branch information
arjen-t authored Mar 6, 2024
1 parent 9ede2c6 commit a6fc2d9
Showing 1 changed file with 13 additions and 7 deletions.
20 changes: 13 additions & 7 deletions manager/controllers/default/resource/create.class.php
Original file line number Diff line number Diff line change
Expand Up @@ -249,14 +249,20 @@ public function getDefaultTemplate() {
'FCSet.active' => true,
'Profile.active' => true,
));

$criteriaUserGroups = [];

if(!empty($userGroups)){
$criteriaUserGroups['ProfileUserGroup.usergroup:IN'] = $userGroups;
}

$criteriaUserGroups[] = array(
'OR:ProfileUserGroup.usergroup:IS' => null,
'AND:UGProfile.active:=' => true,
);

$c->where(array(
array(
'ProfileUserGroup.usergroup:IN' => $userGroups,
array(
'OR:ProfileUserGroup.usergroup:IS' => null,
'AND:UGProfile.active:=' => true,
),
),
$criteriaUserGroups,
'OR:ProfileUserGroup.usergroup:=' => null,
),xPDOQuery::SQL_AND,null,2);
/** @var modActionDom $fcDt see http://tracker.modx.com/issues/9592 */
Expand Down

0 comments on commit a6fc2d9

Please sign in to comment.