2.8.15

application/config/config.sample.php

@@ -513,7 +513,11 @@
 $config['sess_driver'] = 'files';
 $config['sess_cookie_name'] = 'ci_cloudlog';
 $config['sess_expiration'] = 0;
-$config['sess_save_path'] = '/tmp';
+$cloudlog_session_path = sys_get_temp_dir() . DIRECTORY_SEPARATOR . 'cloudlog_' . md5((string) (realpath(FCPATH) ?: FCPATH)) . '_sessions';
+if (!is_dir($cloudlog_session_path)) {
+	@mkdir($cloudlog_session_path, 0700, true);
+}
+$config['sess_save_path'] = $cloudlog_session_path;
 $config['sess_match_ip'] = FALSE;
 $config['sess_time_to_update'] = 300;
 $config['sess_regenerate_destroy'] = FALSE;

application/config/migration.php

@@ -22,7 +22,7 @@
 |
 */
 
-$config['migration_version'] = 271;
+$config['migration_version'] = 272;
 
 /*
 |--------------------------------------------------------------------------

application/controllers/Awards.php

@@ -84,7 +84,7 @@ public function dok()
         }
 
         if ($logbooks_locations_array) {
-            $location_list = "'" . implode("','", $logbooks_locations_array) . "'";
+            $location_list = implode(',', array_map('intval', $logbooks_locations_array));
             $data['dok_array'] = $this->dok->get_dok_array($bands, $postdata, $location_list);
             $data['dok_summary'] = $this->dok->get_dok_summary($bands, $postdata, $location_list);
         } else {
@@ -1715,7 +1715,7 @@ public function get_dxcc_qsos()
     {
         $this->load->model('logbooks_model');
 
-        $dxcc_id = $this->security->xss_clean($this->input->post('dxcc_id'));
+        $dxcc_id = (int) $this->security->xss_clean($this->input->post('dxcc_id'));
         $limit = $this->security->xss_clean($this->input->post('limit')) ?: 20;
 
         if (!$dxcc_id || !is_numeric($dxcc_id)) {
@@ -1732,7 +1732,7 @@ public function get_dxcc_qsos()
             return;
         }
 
-        $location_list = "'" . implode("','", $logbooks_locations_array) . "'";
+        $location_list = implode(',', array_map('intval', $logbooks_locations_array));
 
         try {
             // Get QSOs for this DXCC
@@ -1776,7 +1776,7 @@ public function get_dxcc_qsos_by_status()
     {
         $this->load->model('logbooks_model');
 
-        $dxcc_id = $this->security->xss_clean($this->input->post('dxcc_id'));
+        $dxcc_id = (int) $this->security->xss_clean($this->input->post('dxcc_id'));
         $status = $this->security->xss_clean($this->input->post('status'));
         $limit = $this->security->xss_clean($this->input->post('limit')) ?: 100;
 
@@ -1794,7 +1794,7 @@ public function get_dxcc_qsos_by_status()
             return;
         }
 
-        $location_list = "'" . implode("','", $logbooks_locations_array) . "'";
+        $location_list = implode(',', array_map('intval', $logbooks_locations_array));
 
         try {
             // Build WHERE clause for status filter
@@ -1864,7 +1864,7 @@ public function get_continent_qsos()
             return;
         }
 
-        $location_list = "'" . implode("','", $logbooks_locations_array) . "'";
+        $location_list = implode(',', array_map('intval', $logbooks_locations_array));
 
         try {
             // Get all DXCC entities for this continent with their status in a single query
@@ -1881,7 +1881,7 @@ public function get_continent_qsos()
                     END as status
                 FROM dxcc_entities d
                 LEFT JOIN " . $this->config->item('table_name') . " c ON d.adif = c.col_dxcc AND c.station_id IN (" . $location_list . ")
-                WHERE d.cont = '" . $this->db->escape_like_str($continent_code) . "'
+                WHERE d.cont = '" . $this->db->escape_str($continent_code) . "'
                 GROUP BY d.adif, d.name, d.prefix, d.cont
                 ORDER BY d.name ASC
             ");

application/controllers/Contesting.php

@@ -121,7 +121,7 @@ public function edit($id) {
 		$this->load->model('Contesting_model');
 		$this->load->library('form_validation');
 
-		$item_id_clean = $this->security->xss_clean($id);
+		$item_id_clean = (int) $id;
 
 		$data['contest'] = $this->Contesting_model->contest($item_id_clean);
 

application/controllers/Labels.php

@@ -143,7 +143,7 @@ public function printids() {
 	}
 
 	public function print($station_id) {
-		$clean_id = xss_clean($station_id);
+		$clean_id = (int) $station_id;
 		$offset = xss_clean($this->input->post('startat'));
 		$grid = xss_clean($this->input->post('grid') ?? 0);
 		$via = xss_clean($this->input->post('via') ?? 0);
@@ -397,7 +397,7 @@ function generateLabel($pdf, $current_callsign, $tableData,$numofqsos,$qso,$orie
 	public function edit($id) {
 		$this->load->model('labels_model');
 
-		$cleanid = $this->security->xss_clean($id);
+		$cleanid = (int) $id;
 
 		$data['label'] = $this->labels_model->getLabel($cleanid,$this->session->userdata('user_id'));
 
@@ -425,7 +425,7 @@ public function delete($id) {
 	}
 
 	public function saveDefaultLabel() {
-		$id = $this->input->post('id');
+		$id = (int) $this->input->post('id');
 		$this->load->model('labels_model');
 		$this->labels_model->saveDefaultLabel($id);
 	}
@@ -438,7 +438,7 @@ public function startAtLabel() {
 	public function editPaper($id) {
 		$this->load->model('labels_model');
 
-		$cleanid = $this->security->xss_clean($id);
+		$cleanid = (int) $id;
 
 		$data['paper'] = $this->labels_model->getPaper($cleanid);
 
@@ -455,7 +455,7 @@ public function updatePaper($id) {
 			$this->labels_model->updatePaper($id);
 		} catch (\Throwable $th) {
 			$this->session->set_flashdata('error', 'Your paper could not be saved. Remember that it can\'t have the same name as existing paper types.');
-			$cleanid = $this->security->xss_clean($id);
+			$cleanid = (int) $id;
 			redirect('labels/editpaper/'.$cleanid);
 		}
 		$this->session->set_flashdata('message', 'Paper was saved.');

application/controllers/Lookup.php

@@ -31,7 +31,7 @@ public function search() {
 		$CI->load->model('logbooks_model');
 		$logbooks_locations_array = $CI->logbooks_model->list_logbook_relationships($this->session->userdata('active_station_logbook'));
 
-		$location_list = "'".implode("','",$logbooks_locations_array)."'";
+		$location_list = implode(',', array_map('intval', $logbooks_locations_array));
 
 		$this->load->model('lookup_model');
 		$this->load->model('bands');

application/controllers/Oqrs.php

@@ -122,7 +122,7 @@ public function requests() {
 		$logbooks_locations_array = $CI->logbooks_model->list_logbook_relationships($this->session->userdata('active_station_logbook'));
 
         if ($logbooks_locations_array) {
-			$location_list = "'".implode("','",$logbooks_locations_array)."'";
+			$location_list = implode(',', array_map('intval', $logbooks_locations_array));
 		} else {
             $location_list = null;
         }

application/controllers/Themes.php

@@ -56,7 +56,7 @@ public function edit($id)
 
 		$this->load->model('Themes_model');
 
-		$item_id_clean = $this->security->xss_clean($id);
+		$item_id_clean = (int) $id;
 
 		$data['theme'] = $this->Themes_model->theme($item_id_clean);
 

application/controllers/Visitor.php

@@ -237,7 +237,7 @@ public function satellites()
 		$data['page_title'] = "Public Gridsquare Map";
 
 		// Get available bands for this logbook
-		$location_list = "'".implode("','",$logbooks_locations_array)."'";
+		$location_list = implode(',', array_map('intval', $logbooks_locations_array));
 
 		// Get bands (excluding satellites) 
 		$bands_query = $this->db->query(

application/migrations/272_tag_2_8_15.php

@@ -0,0 +1,30 @@
+<?php
+
+defined('BASEPATH') OR exit('No direct script access allowed');
+
+/*
+*   Tag Cloudlog as 2.8.15 Migration
+*/
+
+class Migration_tag_2_8_15 extends CI_Migration {
+
+    public function up()
+    {
+
+        // Tag Cloudlog 2.8.15
+        $this->db->where('option_name', 'version');
+        $this->db->update('options', array('option_value' => '2.8.15'));
+
+        // Trigger Version Info Dialog
+        $this->db->where('option_type', 'version_dialog');
+        $this->db->where('option_name', 'confirmed');
+        $this->db->update('user_options', array('option_value' => 'false'));
+
+    }
+
+    public function down()
+    {
+        $this->db->where('option_name', 'version');
+        $this->db->update('options', array('option_value' => '2.8.14'));
+    }
+}

application/models/Accumulate_model.php

@@ -12,7 +12,10 @@ function get_accumulated_data($band, $award, $mode, $period) {
             return array();
         }
 
-		$location_list = "'".implode("','",$logbooks_locations_array)."'";
+        $location_ids = array_map('intval', $logbooks_locations_array);
+        $location_list = implode(',', $location_ids);
+        $band = $this->db->escape_str($band);
+        $mode = $this->db->escape_str($mode);
 
         switch ($award) {
             case 'dxcc': $result = $this->get_accumulated_dxcc($band, $mode, $period, $location_list); break;

application/models/Activated_gridmap_model.php

@@ -11,7 +11,10 @@ function get_band_confirmed($band, $mode, $qsl, $lotw, $eqsl, $qrz, $sat) {
             return null;
         }
 
-		$location_list = "'".implode("','",$logbooks_locations_array)."'";
+        $location_list = implode(',', array_map('intval', $logbooks_locations_array));
+        $band = $this->db->escape_str($band);
+        $mode = $this->db->escape_str($mode);
+        $sat = $this->db->escape_str($sat);
 
         $sql = 'SELECT DISTINCT station_gridsquare AS GRID_SQUARES, COL_BAND FROM '
            . 'station_profile JOIN '.$this->config->item('table_name').' on '.$this->config->item('table_name').'.station_id = station_profile.station_id '
@@ -48,7 +51,10 @@ function get_band($band, $mode, $qsl, $lotw, $eqsl, $qrz, $sat) {
             return null;
         }
 
-        $location_list = "'".implode("','",$logbooks_locations_array)."'";
+        $location_list = implode(',', array_map('intval', $logbooks_locations_array));
+        $band = $this->db->escape_str($band);
+        $mode = $this->db->escape_str($mode);
+        $sat = $this->db->escape_str($sat);
 
         $sql = 'SELECT DISTINCT station_gridsquare AS GRID_SQUARES, COL_BAND FROM '
            . 'station_profile JOIN '.$this->config->item('table_name').' on '.$this->config->item('table_name').'.station_id = station_profile.station_id '
@@ -84,7 +90,10 @@ function get_band_worked_vucc_squares($band, $mode, $qsl, $lotw, $eqsl, $qrz, $s
             return null;
         }
 
-        $location_list = "'".implode("','",$logbooks_locations_array)."'";
+        $location_list = implode(',', array_map('intval', $logbooks_locations_array));
+        $band = $this->db->escape_str($band);
+        $mode = $this->db->escape_str($mode);
+        $sat = $this->db->escape_str($sat);
 
 		$sql = 'SELECT distinct COL_VUCC_GRIDS, COL_BAND FROM '
 			.$this->config->item('table_name')
@@ -121,7 +130,10 @@ function get_band_confirmed_vucc_squares($band, $mode, $qsl, $lotw, $eqsl, $qrz,
             return null;
         }
 
-		$location_list = "'".implode("','",$logbooks_locations_array)."'";
+        $location_list = implode(',', array_map('intval', $logbooks_locations_array));
+        $band = $this->db->escape_str($band);
+        $mode = $this->db->escape_str($mode);
+        $sat = $this->db->escape_str($sat);
 
 		$sql = 'SELECT distinct COL_VUCC_GRIDS, COL_BAND FROM '
 			.$this->config->item('table_name')
@@ -188,7 +200,7 @@ function get_worked_modes() {
             return null;
         }
 
-		$location_list = "'".implode("','",$logbooks_locations_array)."'";
+        $location_list = implode(',', array_map('intval', $logbooks_locations_array));
 
 		// get all worked modes from database
 		$data = $this->db->query(