Update conference_session_details.php

app/conference_centers/conference_session_details.php

@@ -17,7 +17,7 @@
 
 	The Initial Developer of the Original Code is
 	Mark J Crane <markjcrane@fusionpbx.com>
-	Copyright (C) 2008-2012 All Rights Reserved.
+	Copyright (C) 2008-2019 All Rights Reserved.
 
 	Contributor(s):
 	Mark J Crane <markjcrane@fusionpbx.com>
@@ -46,30 +46,46 @@
 	require_once "resources/paging.php";
 
 //set variables from the http values
-	$order_by = check_str($_GET["order_by"]);
+	$order_by = $_GET["order_by"];
-	$order = check_str($_GET["order"]);
+	$order = $_GET['order'];
-	$conference_session_uuid = check_str($_GET["uuid"]);
+	$conference_session_uuid = $_GET["uuid"];
+
+//validate order by
+	if (strlen($order_by) > 0) {
+		$order_by = preg_replace('#[^a-zA-Z0-9_\-]#', '', $order_by);
+	}
+
+//validate the order
+	switch ($order) {
+		case 'asc':
+			break;
+		case 'desc':
+			break;
+		default:
+			$order = '';
+	}
 
 //add meeting_uuid to a session variable
-	if (strlen($conference_session_uuid) > 0) {
+	if (strlen($conference_session_uuid) > 0 && is_uuid($conference_session_uuid)) {
 		$_SESSION['meeting']['session_uuid'] = $conference_session_uuid;
 	}
 
 //get the list
 	$sql = "select * from v_conference_sessions ";
-	$sql .= "where domain_uuid = '$domain_uuid' ";
+	$sql .= "where domain_uuid = :domain_uuid ";
-	$sql .= "and conference_session_uuid = '".$_SESSION['meeting']['session_uuid']."' ";
+	$sql .= "and conference_session_uuid = :conference_session_uuid ";
-	$prep_statement = $db->prepare(check_sql($sql));
+	$parameters['domain_uuid'] = $_SESSION['domain_uuid'];
-	$prep_statement->execute();
+	$parameters['conference_session_uuid'] = $_SESSION['meeting']['session_uuid'];
-	$result = $prep_statement->fetchAll();
+	$database = new database;
-	foreach ($result as &$row) {
+	$conference_sessions = $database->select($sql, $parameters, 'all');
+	foreach ($conference_sessions as $row) {
 		$meeting_uuid = $row["meeting_uuid"];
 		$recording = $row["recording"];
 		$start_epoch = $row["start_epoch"];
 		$end_epoch = $row["end_epoch"];
 		$profile = $row["profile"];
 	}
-	unset ($prep_statement);
+	unset ($conference_sessions, $parameters);
 
 //set the year, month and day based on the session start epoch
 	$tmp_year = date("Y", $start_epoch);
@@ -116,23 +132,16 @@
 
 //prepare to page the results
 	$sql = "select count(*) as num_rows from v_conference_session_details ";
-		$sql .= "where domain_uuid = '$domain_uuid' ";
+	$sql .= "where domain_uuid = :domain_uuid ";
-		$sql .= "and conference_session_uuid = '".$_SESSION['meeting']['session_uuid']."' ";
+	$sql .= "and conference_session_uuid = :conference_session_uuid ";
-		$prep_statement = $db->prepare($sql);
+	$parameters['domain_uuid'] = $_SESSION['domain_uuid'];
-		if ($prep_statement) {
+	$parameters['conference_session_uuid'] = $_SESSION['meeting']['session_uuid'];
-		$prep_statement->execute();
+	$num_rows = $database->select($sql, $parameters, 'column');
-			$row = $prep_statement->fetch(PDO::FETCH_ASSOC);
+	unset($parameters);
-			if ($row['num_rows'] > 0) {
-				$num_rows = $row['num_rows'];
-			}
-			else {
-				$num_rows = '0';
-			}
-		}
 
 //prepare to page the results
 	$rows_per_page = ($_SESSION['domain']['paging']['numeric'] != '') ? $_SESSION['domain']['paging']['numeric'] : 50;
-		$param = "";
+	$param = '';
 	$page = $_GET['page'];
 	if (strlen($page) == 0) { $page = 0; $_GET['page'] = 0; }
 	list($paging_controls, $rows_per_page, $var3) = paging($num_rows, $param, $rows_per_page);
@@ -140,24 +149,28 @@
 
 //get the list
 	$sql = "select * from v_conference_session_details ";
-		$sql .= "where domain_uuid = '$domain_uuid' ";
+	$sql .= "where domain_uuid = :domain_uuid ";
-		$sql .= "and conference_session_uuid = '".$_SESSION['meeting']['session_uuid']."' ";
+	$sql .= "and conference_session_uuid = :conference_session_uuid ";
 	if (strlen($order_by) == 0) {
 		$sql .= "order by start_epoch asc ";
 	}
 	else {
 		$sql .= "order by $order_by $order ";
 	}
-		$sql .= "limit $rows_per_page offset $offset ";
+	$sql .= "limit :rows_per_page offset :offset ";
-		$prep_statement = $db->prepare(check_sql($sql));
+	$parameters['domain_uuid'] = $_SESSION['domain_uuid'];
-		$prep_statement->execute();
+	$parameters['conference_session_uuid'] = $_SESSION['meeting']['session_uuid'];
-		$conference_session_details = $prep_statement->fetchAll();
+	$parameters['rows_per_page'] = $rows_per_page;
-		unset ($prep_statement, $sql);
+	$parameters['offset'] = $offset;
+	$conference_session_details = $database->select($sql, $parameters, 'all');
+	unset ($parameters);
 
+//show the styles
 	$c = 0;
 	$row_style["0"] = "row_style0";
 	$row_style["1"] = "row_style1";
 
+//show the conent
 	echo "<table class='tr_hover' width='100%' border='0' cellpadding='0' cellspacing='0'>\n";
 	echo "<tr>\n";
 	//echo th_order_by('meeting_uuid', 'Meeting UUID', $order_by, $order);