Bug #5614

Insufficient parameter checking in joinAdd()

Details

Request #5614	Insufficient parameter checking in joinAdd()
Submitted	2005-10-06 05:54 UTC
From	markus at fischer dot name
Assigned	alan_k
Status	Closed
Package	DB_DataObject
PHP Version	4.3.10
OS	Any
Roadmaps	(Not assigned)

Comments

[2005-10-06 05:54 UTC] markus at fischer dot name

Description:
------------
The method joinAdd() doesn't verify if the object passed is a DB_DataObject.

It only verifies if it is an object:
if (!is_object($obj)) {
$this->raiseError("joinAdd: called without an object", DB_DATAOBJECT_ERROR_NODATA,PEAR_ERROR_DIE);
}

but assumed it's an DB_DataObject because it calls the ->links() method:

if (!$ofield && ($olinks = $obj->links())) {

The check should make sure it's a valid DB_DataObject (is_subclass_of) and not just an object.

Test script:
---------------
$oTable1 =& DB_DataObject::factory("table1");
$oTableUnknown =& DB_DataObject::factory("someunknowntable");
$oTable1->joinAdd($oTableUnknown, "INNER");

Expected result:
----------------
An error should be raised.

Actual result:
--------------
Bails out with a fatal error:

Fatal error: Call to undefined function: links() in /data/www/webroot/pear/share/php/DB/DataObject.php on line 2899