[4.0] Installer library - use parameterized queries

libraries/src/Installer/Adapter/ComponentAdapter.php

@@ -22,6 +22,7 @@
 use Joomla\CMS\Filesystem\Folder;
 use Joomla\CMS\Log\Log;
 use Joomla\CMS\Filesystem\Path;
+use Joomla\Database\ParameterType;
 
 /**
  * Component installer
@@ -365,12 +366,15 @@ protected function finaliseInstall()
 	 */
 	protected function finaliseUninstall(): bool
 	{
+		$extensionId = $this->extension->extension_id;
+
 		$db = $this->parent->getDbo();
 
 		// Remove the schema version
 		$query = $db->getQuery(true)
 			->delete('#__schemas')
-			->where('extension_id = ' . $this->extension->extension_id);
+			->where('extension_id = :extension_id')
+			->bind(':extension_id', $extensionId, ParameterType::INTEGER);
 		$db->setQuery($query);
 		$db->execute();
 
@@ -382,11 +386,16 @@ protected function finaliseUninstall(): bool
 			$asset->delete();
 		}
 
+		$extensionName = $this->element;
+		$extensionNameWithWildcard = $extensionName . '.%';
+
 		// Remove categories for this component
 		$query->clear()
 			->delete('#__categories')
-			->where('extension = ' . $db->quote($this->element), 'OR')
-			->where('extension LIKE ' . $db->quote($this->element . '.%'));
+			->where('extension = :extension')
+			->where('extension LIKE :extension_wildcard')
+			->bind(':extension', $extensionName)
+			->bind(':extension_wildcard', $extensionNameWithWildcard);
 		$db->setQuery($query);
 		$db->execute();
 
@@ -586,15 +595,22 @@ public function prepareDiscoverInstall()
 		}
 		catch (\RuntimeException $e)
 		{
+			$name = $this->extension->name;
+			$type = $this->extension->type;
+			$element = $this->extension->element;
+
 			// Try to delete existing failed records before retrying
 			$db = $this->db;
 
 			$query = $db->getQuery(true)
 				->select($db->qn('extension_id'))
 				->from($db->qn('#__extensions'))
-				->where($db->qn('name') . ' = ' . $db->q($this->extension->name))
-				->where($db->qn('type') . ' = ' . $db->q($this->extension->type))
-				->where($db->qn('element') . ' = ' . $db->q($this->extension->element));
+				->where($db->qn('name') . ' = :name')
+				->where($db->qn('type') . ' = :type')
+				->where($db->qn('element') . ' = :element')
+				->bind(':name', $name)
+				->bind(':type', $type)
+				->bind(':element', $element);
 
 			$db->setQuery($query);
 
@@ -773,14 +789,22 @@ protected function storeExtension($deleteExisting = false)
 		// If we are told to delete existing extension entries then do so.
 		if ($deleteExisting)
 		{
-			$db = $this->parent->getDbo();
+			$name = $this->extension->name;
+			$type = $this->extension->type;
+			$element = $this->extension->element;
+
+			// Try to delete existing failed records before retrying
+			$db = $this->db;
 
 			$query = $db->getQuery(true)
 				->select($db->qn('extension_id'))
 				->from($db->qn('#__extensions'))
-				->where($db->qn('name') . ' = ' . $db->q($this->extension->name))
-				->where($db->qn('type') . ' = ' . $db->q($this->extension->type))
-				->where($db->qn('element') . ' = ' . $db->q($this->extension->element));
+				->where($db->qn('name') . ' = :name')
+				->where($db->qn('type') . ' = :type')
+				->where($db->qn('element') . ' = :element')
+				->bind(':name', $name)
+				->bind(':type', $type)
+				->bind(':element', $element);
 
 			$db->setQuery($query);
 
@@ -848,7 +872,6 @@ protected function storeExtension($deleteExisting = false)
 	protected function _buildAdminMenus($component_id = null)
 	{
 		$db     = $this->parent->getDbo();
-
 		$option = $this->element;
 
 		// If a component exists with this option in the table within the protected menutype 'main' then we don't need to add menus
@@ -859,7 +882,8 @@ protected function _buildAdminMenus($component_id = null)
 			->where('m.parent_id = 1')
 			->where('m.client_id = 1')
 			->where('m.menutype = ' . $db->quote('main'))
-			->where('e.element = ' . $db->quote($option));
+			->where('e.element = :element')
+			->bind(':element', $option);
 
 		$db->setQuery($query);
 
@@ -1069,7 +1093,8 @@ protected function _removeAdminMenus($id)
 			->from('#__menu')
 			->where($db->quoteName('client_id') . ' = 1')
 			->where($db->quoteName('menutype') . ' = ' . $db->q('main'))
-			->where($db->quoteName('component_id') . ' = ' . (int) $id);
+			->where($db->quoteName('component_id') . ' = :id')
+			->bind(':id', $id, ParameterType::INTEGER);
 
 		$db->setQuery($query);
 
@@ -1293,16 +1318,27 @@ protected function _createAdminMenuItem(array &$data, $parentId)
 
 		if (!$table->bind($data) || !$table->check() || !$table->store())
 		{
+			$menutype     = $data['menutype'];
+			$link         = $data['link'];
+			$type         = $data['type'];
+			$menuParentId = $data['parent_id'];
+			$home         = $data['home'];
+
 			// The menu item already exists. Delete it and retry instead of throwing an error.
 			$query = $db->getQuery(true)
 				->select('id')
 				->from('#__menu')
-				->where('menutype = ' . $db->q($data['menutype']))
+				->where('menutype = :menutype')
 				->where('client_id = 1')
-				->where('link = ' . $db->q($data['link']))
-				->where('type = ' . $db->q($data['type']))
-				->where('parent_id = ' . $db->q($data['parent_id']))
-				->where('home = ' . $db->q($data['home']));
+				->where('link = :link')
+				->where('type = :type')
+				->where('parent_id = :parent_id')
+				->where('home = :home')
+				->bind(':menutype', $menutype)
+				->bind(':link', $link)
+				->bind(':type', $type)
+				->bind(':parent_id', $menuParentId, ParameterType::INTEGER)
+				->bind(':home', $home, ParameterType::BOOLEAN);
 
 			$db->setQuery($query);
 			$menu_id = $db->loadResult();

libraries/src/Installer/Adapter/FileAdapter.php

@@ -18,6 +18,7 @@
 use Joomla\CMS\Filesystem\Folder;
 use Joomla\CMS\Log\Log;
 use Joomla\CMS\Filesystem\Path;
+use Joomla\Database\ParameterType;
 
 /**
  * File installer
@@ -158,12 +159,15 @@ protected function finaliseUninstall(): bool
 	{
 		File::delete(JPATH_MANIFESTS . '/files/' . $this->extension->element . '.xml');
 
+		$extensionId = $this->extension->extension_id;
+
 		$db = $this->parent->getDbo();
 
 		// Remove the schema version
 		$query = $db->getQuery(true)
 			->delete('#__schemas')
-			->where('extension_id = ' . $this->extension->extension_id);
+			->where('extension_id = :extension_id')
+			->bind(':extension_id', $extensionId, ParameterType::INTEGER);
 		$db->setQuery($query);
 		$db->execute();
 
@@ -457,7 +461,8 @@ protected function extensionExistsInSystem($extension = null)
 			->select($db->quoteName('extension_id'))
 			->from($db->quoteName('#__extensions'))
 			->where($db->quoteName('type') . ' = ' . $db->quote('file'))
-			->where($db->quoteName('element') . ' = ' . $db->quote($extension));
+			->where($db->quoteName('element') . ' = :extension')
+			->bind(':extension', $extension);
 		$db->setQuery($query);
 
 		try

libraries/src/Installer/Adapter/LanguageAdapter.php

@@ -18,6 +18,7 @@
 use Joomla\CMS\Language\LanguageHelper;
 use Joomla\CMS\Table\Table;
 use Joomla\CMS\Table\Update;
+use Joomla\Database\ParameterType;
 use Joomla\Registry\Registry;
 use Joomla\CMS\Factory;
 use Joomla\CMS\Language\Text;
@@ -135,10 +136,13 @@ protected function finaliseUninstall(): bool
 			}
 		}
 
+		$extensionId = $this->extension->extension_id;
+
 		// Remove the schema version
 		$query = $db->getQuery(true)
 			->delete('#__schemas')
-			->where('extension_id = ' . $this->extension->extension_id);
+			->where('extension_id = :extension_id')
+			->bind(':extension_id', $extensionId, ParameterType::INTEGER);
 		$db->setQuery($query);
 		$db->execute();
 

libraries/src/Installer/Adapter/LibraryAdapter.php

@@ -21,6 +21,7 @@
 use Joomla\CMS\Filesystem\Folder;
 use Joomla\CMS\Log\Log;
 use Joomla\CMS\Filesystem\Path;
+use Joomla\Database\ParameterType;
 
 /**
  * Library installer
@@ -151,12 +152,15 @@ protected function finaliseInstall()
 	 */
 	protected function finaliseUninstall(): bool
 	{
+		$extensionId = $this->extension->extension_id;
+
 		$db = $this->parent->getDbo();
 
 		// Remove the schema version
 		$query = $db->getQuery(true)
 			->delete('#__schemas')
-			->where('extension_id = ' . $this->extension->extension_id);
+			->where('extension_id = :extension_id')
+			->bind(':extension_id', $extensionId, ParameterType::INTEGER);
 		$db->setQuery($query);
 		$db->execute();
 
@@ -454,7 +458,8 @@ public function update()
 			->select($db->quoteName('extension_id'))
 			->from($db->quoteName('#__extensions'))
 			->where($db->quoteName('type') . ' = ' . $db->quote('library'))
-			->where($db->quoteName('element') . ' = ' . $db->quote($element));
+			->where($db->quoteName('element') . ' = :element')
+			->bind(':element', $element);
 		$db->setQuery($query);
 		$result = $db->loadResult();
 

libraries/src/Installer/Adapter/ModuleAdapter.php

@@ -14,6 +14,7 @@
 use Joomla\CMS\Installer\Installer;
 use Joomla\CMS\Installer\InstallerAdapter;
 use Joomla\CMS\Table\Table;
+use Joomla\Database\ParameterType;
 use Joomla\Utilities\ArrayHelper;
 use Joomla\CMS\Language\Text;
 use Joomla\CMS\Filesystem\Folder;
@@ -212,22 +213,30 @@ protected function finaliseInstall()
 	 */
 	protected function finaliseUninstall(): bool
 	{
+		$extensionId = $this->extension->extension_id;
+
 		$db     = $this->parent->getDbo();
 		$retval = true;
 
 		// Remove the schema version
 		$query = $db->getQuery(true)
 			->delete('#__schemas')
-			->where('extension_id = ' . $this->extension->extension_id);
+			->where('extension_id = :extension_id')
+			->bind(':extension_id', $extensionId, ParameterType::INTEGER);
 		$db->setQuery($query);
 		$db->execute();
 
+		$element  = $this->extension->element;
+		$clientId = $this->extension->client_id;
+
 		// Let's delete all the module copies for the type we are uninstalling
 		$query->clear()
 			->select($db->quoteName('id'))
 			->from($db->quoteName('#__modules'))
-			->where($db->quoteName('module') . ' = ' . $db->quote($this->extension->element))
-			->where($db->quoteName('client_id') . ' = ' . (int) $this->extension->client_id);
+			->where($db->quoteName('module') . ' = :element')
+			->where($db->quoteName('client_id') . ' = :client_id')
+			->bind(':element', $element)
+			->bind(':client_id', $clientId, ParameterType::INTEGER);
 		$db->setQuery($query);
 
 		try
@@ -282,8 +291,10 @@ protected function finaliseUninstall(): bool
 		$this->extension->delete($this->extension->extension_id);
 		$query = $db->getQuery(true)
 			->delete($db->quoteName('#__modules'))
-			->where($db->quoteName('module') . ' = ' . $db->quote($this->extension->element))
-			->where($db->quote('client_id') . ' = ' . $this->extension->client_id);
+			->where($db->quoteName('module') . ' = :element')
+			->where($db->quoteName('client_id') . ' = :client_id')
+			->bind(':element', $element)
+			->bind(':client_id', $clientId, ParameterType::INTEGER);
 		$db->setQuery($query);
 
 		try
@@ -681,10 +692,13 @@ protected function _rollback_menu($arg)
 		// Get database connector object
 		$db = $this->parent->getDbo();
 
+		$moduleId = $arg['id'];
+
 		// Remove the entry from the #__modules_menu table
 		$query = $db->getQuery(true)
 			->delete($db->quoteName('#__modules_menu'))
-			->where($db->quoteName('moduleid') . ' = ' . (int) $arg['id']);
+			->where($db->quoteName('moduleid') . ' = :module_id')
+			->bind(':module_id', $moduleId, ParameterType::INTEGER);
 		$db->setQuery($query);
 
 		try
@@ -712,10 +726,13 @@ protected function _rollback_module($arg)
 		// Get database connector object
 		$db = $this->parent->getDbo();
 
+		$moduleId = $arg['id'];
+
 		// Remove the entry from the #__modules table
 		$query = $db->getQuery(true)
 			->delete($db->quoteName('#__modules'))
-			->where($db->quoteName('id') . ' = ' . (int) $arg['id']);
+			->where($db->quoteName('id') . ' = :module_id')
+			->bind(':module_id', $moduleId, ParameterType::INTEGER);
 		$db->setQuery($query);
 
 		try

libraries/src/Installer/Adapter/PackageAdapter.php

@@ -17,6 +17,7 @@
 use Joomla\CMS\Installer\Manifest\PackageManifest;
 use Joomla\CMS\Table\Table;
 use Joomla\CMS\Table\Update;
+use Joomla\Database\ParameterType;
 use Joomla\Event\Event;
 use Joomla\CMS\Factory;
 use Joomla\CMS\Language\Text;
@@ -308,12 +309,15 @@ protected function finaliseInstall()
 	 */
 	protected function finaliseUninstall(): bool
 	{
+		$extensionId = $this->extension->extension_id;
+
 		$db = $this->parent->getDbo();
 
 		// Remove the schema version
 		$query = $db->getQuery(true)
 			->delete('#__schemas')
-			->where('extension_id = ' . $this->extension->extension_id);
+			->where('extension_id = :extension_id')
+			->bind(':extension_id', $extensionId, ParameterType::INTEGER);
 		$db->setQuery($query);
 		$db->execute();
 
@@ -676,14 +680,18 @@ protected function _getExtensionId($type, $id, $client, $group)
 		$query = $db->getQuery(true)
 			->select('extension_id')
 			->from('#__extensions')
-			->where('type = ' . $db->quote($type))
-			->where('element = ' . $db->quote($id));
+			->where('type = :type')
+			->where('element = :element')
+			->bind(':type', $type)
+			->bind(':element', $id);
 
 		switch ($type)
 		{
 			case 'plugin':
 				// Plugins have a folder but not a client
-				$query->where('folder = ' . $db->quote($group));
+				$query->where('folder = :folder')
+					->bind(':folder', $group);
+
 				break;
 
 			case 'library':
@@ -697,8 +705,11 @@ protected function _getExtensionId($type, $id, $client, $group)
 			case 'module':
 			case 'template':
 				// Languages, modules and templates have a client but not a folder
-				$client = ApplicationHelper::getClientInfo($client, true);
-				$query->where('client_id = ' . (int) $client->id);
+				$clientId = ApplicationHelper::getClientInfo($client, true)->id;
+
+				$query->where('client_id = :client_id')
+					->bind(':client_id', $clientId, ParameterType::INTEGER);
+
 				break;
 		}