Tags

SQL injection in the product catalog

select_products_by_category() validates the key into $itemKey, then guards on isset($key) and interpolates the RAW $key into SQL. The validated value is dead code one variable name away.

✓ FIXED — CatalogDAO now interpolates the validated $itemKey and guards isset($itemKey); malicious keys sanitise to NULL.

ProductDAO never opens a connection

The constructor sets $this->table but omits the CreateConnection()->open() every sibling DAO has. First query dereferences null.

✓ FIXED — the constructor now opens the STORE connection like sibling DAOs.

OrderDAO::updateRow calls a method that does not exist

Calls $this->insert() (no such method) and passes a bare key to delete() where a WHERE-clause is expected.

✓ FIXED — updateRow now uses deleteRow() (a WHERE clause) and insertRow() (the real insert).

Empty result set returns null, not []

returnAllBeans() inits to NULL and only fills in-loop; a zero-row query returns null and callers do current(null) -> TypeError.

✓ FIXED — returnAllBeans() now inits array(); a zero-row query returns [].

A missing page crashes the front controller

Controller::display passes a possibly-null document to setData(), which does get_class(null). Silent false in PHP 5; fatal TypeError in PHP 8.

✓ RESOLVED — setData guards get_class with is_object(); DocumentManager falls back to the invalid document for missing pages.

Unbounded tag recursion (stored-content DoS)

execute_all_tags recurses into a tag’s rendered output with no depth/visited guard. A document whose Title is <<<TitleTag>>> loops forever.

✓ FIXED — execute_all_tags now caps recursion depth at 64.

Config constants referenced but never defined

The store/order/auth modules use MYSQL_STORE_DATABASE, ETC, … that Constants.php never defines. Undefined constants are fatal on PHP 8 — why Install.txt says “does not execute.”

✓ RESOLVED — config-as-data (constants.default.json + configure.php) now defines MYSQL_*, ETC, ….

Command queue runs in reverse

execute() drains the queue with array_pop(), so commands fire last-in-first-out.