cassandra / arc-console Goto Github PK

In the mainview I see this error on the left site in the middle:

SQL-ERR 'SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '296''' at line 1', statement was 'select E.*,M.Name as MonitorName,M.Width,M.Height,M.DefaultRate,M.DefaultScale from Events as E inner join Monitors as M on E.MonitorId = M.Id where E.Id = ''296'''

When I click on a camera I get this error instead of the livestream:

SQL-ERR 'SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '1''' at line 1', statement was 'select C., M. from Monitors as M left join Controls as C on (M.ControlId = C.Id ) where M.Id = ''1'''

The PDO::quote() method used by dbEscape() has changed behavior and partially broken this skin. It used to simply escape any nasty characters in string. It now adds single quotes around the string as well. Thus:

dbEscape(50)

becomes '50'

Thus (in arc-event.php):

$sql = "select E.*,M.Name as MonitorName,M.Width,M.Height,M.DefaultRate,M.DefaultScale from Events as E inner join Monitors as M on E.MonitorId = M.Id where E.Id = '".dbEscape($eid)."'".$midSql;

Becomes an error because $eid is double escaped. This occurs a few times throughout the skin. The solution is to remove the ' characters around it.