[4.0] Add prepared statements for mod_related_items

modules/mod_related_items/Helper/RelatedItemsHelper.php

@@ -16,6 +16,7 @@
 use Joomla\CMS\Language\Text;
 use Joomla\CMS\Router\Route;
 use Joomla\Component\Content\Administrator\Extension\ContentComponent;
+use Joomla\Database\ParameterType;
 
 /**
  * Helper for mod_related_items
@@ -33,12 +34,13 @@ abstract class RelatedItemsHelper
 	 */
 	public static function getList(&$params)
 	{
-		$db      = Factory::getDbo();
-		$app     = Factory::getApplication();
-		$input   = $app->input;
-		$groups  = implode(',', Factory::getUser()->getAuthorisedViewLevels());
-		$maximum = (int) $params->get('maximum', 5);
-		$factory = $app->bootComponent('com_content')->getMVCFactory();
+		$db        = Factory::getDbo();
+		$app       = Factory::getApplication();
+		$input     = $app->input;
+		$groups    = Factory::getUser()->getAuthorisedViewLevels();
+		$maximum   = (int) $params->get('maximum', 5);
+		$factory   = $app->bootComponent('com_content')->getMVCFactory();
+		$condition = ContentComponent::CONDITION_PUBLISHED;
 
 		// Get an instance of the generic articles model
 		/** @var \Joomla\Component\Content\Site\Model\ArticlesModel $articles */
@@ -52,12 +54,12 @@ public static function getList(&$params)
 
 		if (!($option === 'com_content' && $view === 'article'))
 		{
-			return array();
+			return [];
 		}
 
 		$temp = $input->getString('id');
 		$temp = explode(':', $temp);
-		$id   = $temp[0];
+		$id   = (int) $temp[0];
 
 		$nullDate = $db->getNullDate();
 		$now      = Factory::getDate()->toSql();
@@ -67,9 +69,10 @@ public static function getList(&$params)
 		if ($id)
 		{
 			// Select the meta keywords from the item
-			$query->select('metakey')
-				->from('#__content')
-				->where('id = ' . (int) $id);
+			$query->select($db->quoteName('metakey'))
+				->from($db->quoteName('#__content'))
+				->where($db->quoteName('id') . ' = :id')
+				->bind(':id', $id, ParameterType::INTEGER);
 			$db->setQuery($query);
 
 			try
@@ -102,30 +105,48 @@ public static function getList(&$params)
 			{
 				// Select other items based on the metakey field 'like' the keys found
 				$query->clear()
-					->select('a.id')
-					->from('#__content AS a')
-					->where('a.id != ' . (int) $id)
-					->where('ws.condition = ' . ContentComponent::CONDITION_PUBLISHED)
-					->where('a.access IN (' . $groups . ')');
-
-				$wheres = array();
+					->select($db->quoteName('a.id'))
+					->from($db->quoteName('#__content', 'a'))
+					->leftJoin($db->quoteName('#__workflow_associations', 'wa'), $db->quoteName('wa.item_id') . ' = ' . $db->quoteName('a.id'))
+					->leftJoin($db->quoteName('#__workflow_stages', 'ws'), $db->quoteName('ws.id') . ' = ' . $db->quoteName('wa.stage_id'))
+					->where($db->quoteName('a.id') . ' != :id')
+					->where($db->quoteName('ws.condition') . ' = :condition')
+					->whereIn($db->quoteName('a.access'), $groups)
+					->bind(':id', $id, ParameterType::INTEGER)
+					->bind(':condition', $condition, ParameterType::INTEGER);
+
+				$binds  = [];
+				$wheres = [];
 
 				foreach ($likes as $keyword)
 				{
-					$wheres[] = 'a.metakey LIKE ' . $db->quote('%' . $keyword . '%');
+					$binds[] = '%' . $keyword . '%';
+				}
+
+				$bindNames = $query->bindArray($binds, ParameterType::STRING);
+
+				foreach ($bindNames as $keyword)
+				{
+					$wheres[] = 'a.metakey LIKE ' . $keyword;
 				}
 
 				$query->where('(' . implode(' OR ', $wheres) . ')')
-					->where('(a.publish_up = ' . $db->quote($nullDate) . ' OR a.publish_up <= ' . $db->quote($now) . ')')
-					->where('(a.publish_down = ' . $db->quote($nullDate) . ' OR a.publish_down >= ' . $db->quote($now) . ')');
+					->where('(' . $db->quoteName('a.publish_up') . ' = :nullDate1 OR ' . $db->quoteName('a.publish_up') . ' <= :nowDate1)')
+					->where('(' . $db->quoteName('a.publish_down') . ' = :nullDate2 OR ' . $db->quoteName('a.publish_down') . ' >= :nowDate2)')
+					->bind(':nullDate1', $nullDate)
+					->bind(':nullDate2', $nullDate)
+					->bind(':nowDate1', $now)
+					->bind(':nowDate2', $now);
 
 				// Filter by language
 				if (Multilanguage::isEnabled())
 				{
-					$query->where('a.language in (' . $db->quote(Factory::getLanguage()->getTag()) . ',' . $db->quote('*') . ')');
+					$query->whereIn($db->quoteName('a.language'), [Factory::getLanguage()->getTag(), '*'], ParameterType::STRING);
 				}
 
-				$db->setQuery($query, 0, $maximum);
+				$query->setLimit($maximum);
+
+				$db->setQuery($query);
 
 				try
 				{
@@ -135,7 +156,7 @@ public static function getList(&$params)
 				{
 					$app->enqueueMessage(Text::_('JERROR_AN_ERROR_HAS_OCCURRED'), 'error');
 
-					return array();
+					return [];
 				}
 
 				if (count($articleIds))