[Fmsystem-commits] [7492] property: order by valid columns

[Sigurd Nes]

Revision: 7492
          http://svn.sv.gnu.org/viewvc/?view=rev&root=fmsystem&revision=7492
Author:   sigurdne
Date:     2011-08-11 11:53:20 +0000 (Thu, 11 Aug 2011)
Log Message:
-----------
property: order by valid columns

Modified Paths:
--------------
    trunk/property/inc/class.soagreement.inc.php

Modified: trunk/property/inc/class.soagreement.inc.php
===================================================================
--- trunk/property/inc/class.soagreement.inc.php        2011-08-11 11:33:09 UTC 
(rev 7491)
+++ trunk/property/inc/class.soagreement.inc.php        2011-08-11 11:53:20 UTC 
(rev 7492)
@@ -443,18 +443,32 @@
 
                        if ($order)
                        {
-                               $ordermethod = " order by $entity_table.$order 
$sort";
+                               switch($order)
+                               {
+                                       case 'index_date':
+                                       case 'activity_id':
+                                       case 'index_count':
+                                       case 'total_cost':
+                                       case 'w_cost':
+                                       case 'm_cost':
+                                       case 'num':
+                                       case 'descr':
+                                       case 'unit':
+                                       case 'm_cost':
+                                               $ordermethod = "ORDER BY 
{$entity_table}.{$order} {$sort}";
+                                               break;
+                                       default:
+                                               $ordermethod = '';
+                               }
+                               
                        }
                        else
                        {
-                               $ordermethod = " order by 
$entity_table.activity_id DESC";
+                               $ordermethod = "ORDER BY 
{$entity_table}.activity_id DESC";
                        }
 
+                       $sql = "SELECT {$cols} FROM {$paranthesis} 
{$entity_table} {$joinmethod}";
 
-                       $from = " FROM $paranthesis $entity_table ";
-
-                       $sql = "SELECT $cols $from $joinmethod";
-
                        $this->uicols   = $uicols;
 
                        $where= 'WHERE';