|
@@ -317,11 +317,12 @@ function get_dropbox_categories($filter='')
|
|
|
global $_user;
|
|
|
global $dropbox_cnf;
|
|
|
|
|
|
- //echo '<h1>'.$filter.'</h1>';
|
|
|
-
|
|
|
$return_array=array();
|
|
|
-
|
|
|
- $sql="SELECT * FROM ".$dropbox_cnf['tbl_category']." WHERE user_id='".$_user['user_id']."'";
|
|
|
+
|
|
|
+ $session_id = api_get_session_id();
|
|
|
+ $condition_session = api_get_session_condition($session_id);
|
|
|
+
|
|
|
+ $sql="SELECT * FROM ".$dropbox_cnf['tbl_category']." WHERE user_id='".$_user['user_id']."' $condition_session";
|
|
|
|
|
|
$result=Database::query($sql,__FILE__,__LINE__);
|
|
|
while ($row=Database::fetch_array($result))
|
|
@@ -378,16 +379,17 @@ function store_addcategory()
|
|
|
|
|
|
if (!$_POST['edit_id'])
|
|
|
{
|
|
|
+ $session_id = api_get_session_id();
|
|
|
// step 3a, we check if the category doesn't already exist
|
|
|
- $sql="SELECT * FROM ".$dropbox_cnf['tbl_category']." WHERE user_id='".$_user['user_id']."' AND cat_name='".Database::escape_string(Security::remove_XSS($_POST['category_name']))."' AND received='".$received."' AND sent='".$sent."'";
|
|
|
+ $sql="SELECT * FROM ".$dropbox_cnf['tbl_category']." WHERE user_id='".$_user['user_id']."' AND cat_name='".Database::escape_string(Security::remove_XSS($_POST['category_name']))."' AND received='".$received."' AND sent='$sent' AND session_id='$session_id'";
|
|
|
$result=Database::query($sql,__FILE__,__LINE__);
|
|
|
|
|
|
|
|
|
// step 3b, we add the category if it does not exist yet.
|
|
|
if (Database::num_rows($result)==0)
|
|
|
{
|
|
|
- $sql="INSERT INTO ".$dropbox_cnf['tbl_category']." (cat_name, received, sent, user_id)
|
|
|
- VALUES ('".Database::escape_string(Security::remove_XSS($_POST['category_name']))."', '".Database::escape_string($received)."', '".Database::escape_string($sent)."', '".Database::escape_string($_user['user_id'])."')";
|
|
|
+ $sql="INSERT INTO ".$dropbox_cnf['tbl_category']." (cat_name, received, sent, user_id, session_id)
|
|
|
+ VALUES ('".Database::escape_string(Security::remove_XSS($_POST['category_name']))."', '".Database::escape_string($received)."', '".Database::escape_string($sent)."', '".Database::escape_string($_user['user_id'])."',$session_id)";
|
|
|
Database::query($sql,__FILE__,__LINE__);
|
|
|
return array('type' => 'confirmation', 'message'=>get_lang('CategoryStored'));
|
|
|
}
|