currentpoll.php problem

[Axel Foley]

I received the following error via mail:


Database error in vBulletin 3.0.3:
Invalid SQL:
SELECT thread.pollid, open, threadid, replycount, forumid, question, poll.dateline, options, votes, active, numberoptions, timeout, multiple, voters, public , pollvoteid
FROM vb3_thread AS thread
INNER JOIN vb3_poll AS poll USING (pollid)
LEFT JOIN vb3_pollvote AS pollvote ON (pollvote.pollid = poll.pollid AND pollvote.userid = 3)
LEFT JOIN vb3_deletionlog AS deletionlog ON (thread.threadid = deletionlog.primaryid AND type = 'thread')
WHERE open <> 10 AND thread.pollid != 0 AND visible = 1 AND deletionlog.primaryid IS NULL AND forumid IN(rand) ORDER BY poll.pollid DESC
LIMIT 1
mysql error: Unknown column 'rand' in 'where clause'
mysql error number: 1054

This is not a vb3 native query so I looked at the only hack I installed (guess which one..;)) and I found out the problem is in the query at lines 27-35 of currentpoll.php file:


$pollinfo = $DB_site->query_first("
SELECT thread.pollid, open, threadid, replycount, forumid, question, poll.dateline, options, votes, active, numberoptions, timeout, multiple, voters, public $query[pollfields]
FROM " . TABLE_PREFIX . "thread AS thread
INNER JOIN " . TABLE_PREFIX . "poll AS poll USING (pollid)
$query[polljoin]
$deljoin
WHERE open <> 10 AND thread.pollid != 0 AND visible = 1 $notdeleted $query[pollquery]
LIMIT 1
");



In particular the problem is at the end of the query, the bit of code $query[pollquery], which is defined at lines 12-19 of the same file:


if ($vba_options['portal_poll_forumid'] == 'RAND')
{
$query['pollquery'] = $iforumperms . 'ORDER BY RAND()';
}
else
{
$query['pollquery'] = 'AND forumid IN(' . $vba_options['portal_poll_forumid'] . ') ORDER BY poll.pollid DESC';
}



In my case, it was the else branch, in particular, the . $vba_options['portal_poll_forumid'] . was evaluated in rand which is not a valid column name.

Could you take a look at this please?

Thanks.

[Brian]

The ID number of your polls forum. Enter 0 to disable homepage polls, or enter RAND to pull a random poll from any forum.

Notice it's capitol. ;)

[Axel Foley]

I'd put an strtoupper() if I were you...(never trust user input) ;)

Or better, two radio buttons, the first free input, the second with RAND read-only value...;)

Thanks for the help Brian...:)

[Brian]

Though you're the first person to mention a problem this, it's still a good point. I'll move this to the bugs forum just so it will be a note to myself to do something about this in a future version. :)