[configuration] tag browsing fails if $conf['order_by'] does not start with a space character #135

Closed
opened 2026-10-04 23:44:28 +02:00 by adam · 5 comments
Owner

Reported by plg on 1 Jul 2010 10:57

Version: 2.1.0

If the webmaster forgets to keep the space character in front of the $conf['order_by'] parameter, then it crashes on tag browsing.

Easy solution: in include/common.inc.php add

if (' ' != substr($conf['order_by'], 0, 1))
{
$conf['order_by'] = ' '.$conf['order_by'];
}

Piwigo Bugtracker #1753

**Reported by plg on 1 Jul 2010 10:57** **Version:** 2.1.0 If the webmaster forgets to keep the space character in front of the $conf[&#039;order_by&#039;] parameter, then it crashes on tag browsing. Easy solution: in include/common.inc.php add if (&#039; &#039; != substr($conf[&#039;order_by&#039;], 0, 1)) { $conf[&#039;order_by&#039;] = &#039; &#039;.$conf[&#039;order_by&#039;]; } [Piwigo Bugtracker #1753](http://piwigo.org/bugs/view.php?id=1753) <!-- github-sync-id:97226110 -->
adam closed this issue 2026-10-04 23:44:28 +02:00
Author
Owner

Now (Piwigo 2.7) $conf['order_by'] is generated from configuration screen settings.

Now (Piwigo 2.7) $conf['order_by'] is generated from configuration screen settings. <!-- github-comment-id:124850144 -->
Author
Owner

Comment posted by madman on 25 Jul 2010 16:48

A better solution would be to change the code for this query:

&#039;.$forbidden.
$conf[&#039;order_by&#039;].&#039;

should be changed to

'.$forbidden.'
'.$conf['order_by'].'

This makes it the same as the code on line 298, 447, 484 and 511 (revision 6706 of section_init.inc.php)

**Comment posted by madman on 25 Jul 2010 16:48** A better solution would be to change the code for this query: ``` &#039;.$forbidden. $conf[&#039;order_by&#039;].&#039; ``` should be changed to &#039;.$forbidden.&#039; &#039;.$conf[&#039;order_by&#039;].&#039; This makes it the same as the code on line 298, 447, 484 and 511 (revision 6706 of section_init.inc.php) <!-- github-comment-id:124892088 -->
Author
Owner

Comment posted by plg on 25 Jul 2010 20:43

madman wrote:

> A better solution would be to change the code for this query [...]

I understand your point, but it also means that we need to check all SQL queries using this configuration parameter. That's a possible solution for Piwigo core, but it's not possible for plugins.

My solution requires a minimum of changes and it should avoid the problem everywhere $conf['order_by'] is used.

**Comment posted by plg on 25 Jul 2010 20:43** madman wrote: &gt; A better solution would be to change the code for this query [...] I understand your point, but it also means that we need to check all SQL queries using this configuration parameter. That&#039;s a possible solution for Piwigo core, but it&#039;s not possible for plugins. My solution requires a minimum of changes and it should avoid the problem everywhere $conf[&#039;order_by&#039;] is used. <!-- github-comment-id:124892108 -->
Author
Owner

Comment posted by madman on 25 Jul 2010 21:46

I already checked for it with a normal install. With a Linux system this is quiet easy to do:

grep -Rn order_by * | grep conf | grep -v ".svn"

I don't know if you are familiar with Linux, but this searches all files recursively for the words "order_by" and "conf", but leaves out all files that come with svn (I use a svn checkout, not an svn export).

The output looks like this:
admin/element_set_unit.php:199: '.$conf['order_by'].'
admin/element_set_global.php:454: '.$conf['order_by'].'
include/ws_functions.inc.php:285: $order_by = empty($order_by) ? $conf['order_by'] : 'ORDER BY '.$order_by;
include/ws_functions.inc.php:817: $conf['order_by'] = 'ORDER BY '.$order_by;
include/ws_functions.inc.php:1489: $order_by = $conf['order_by'];
include/section_init.inc.php:176: $conf['order_by'] = $conf['order_by_inside_category'];
include/section_init.inc.php:192: $conf['order_by'] = str_replace(
include/section_init.inc.php:195: $conf['order_by']
include/section_init.inc.php:251: $conf[ 'order_by' ] = ' ORDER BY '.$page['category']['image_order'];
include/section_init.inc.php:298: '.$conf['order_by'].'
include/section_init.inc.php:330: $conf['order_by'].'
include/section_init.inc.php:403: '.$conf['order_by'].'
include/section_init.inc.php:433: $conf['order_by'] = str_replace(
include/section_init.inc.php:436: $conf['order_by']
include/section_init.inc.php:447: '.$conf['order_by'].'
include/section_init.inc.php:477: $conf['order_by'] = ' ORDER BY hit DESC, file ASC';
include/section_init.inc.php:484: '.$conf['order_by'].'
include/section_init.inc.php:503: $conf['order_by'] = ' ORDER BY average_rate DESC, id ASC';
include/section_init.inc.php:511: '.$conf['order_by'].'
include/section_init.inc.php:534: '.$conf['order_by'].'
include/functions_search.inc.php:237: '.$conf['order_by'];
include/functions_search.inc.php:284: '.$conf['order_by'];
include/functions_search.inc.php:564: $conf['order_by'];
include/functions_calendar.inc.php:267: '.$conf['order_by'];
include/functions_calendar.inc.php:282: 'ORDER BY '.$calendar->date_field.$order, $conf['order_by']
include/config_default.inc.php:46:// order_by : how to change the order of display for images in a category ?
include/config_default.inc.php:58:// 1. $conf['order_by'] = " order by date_available desc, file asc";
include/config_default.inc.php:61:// 2. $conf['order_by'] = " order by file asc";
include/config_default.inc.php:64:$conf['order_by'] = ' ORDER BY date_available DESC, file ASC, id ASC';
include/config_default.inc.php:66:// order_by_inside_category : inside a category, images can also be ordered
include/config_default.inc.php:72:// $conf['order_by_inside_category'] = ' ORDER BY rank';
include/config_default.inc.php:74:$conf['order_by_inside_category'] = $conf['order_by'];

Here it is easy to see that these need further inspection:
include/section_init.inc.php:195: $conf['order_by']
include/section_init.inc.php:330: $conf['order_by'].'
include/section_init.inc.php:436: $conf['order_by']
include/functions_search.inc.php:564: $conf['order_by'];

Inspecting the code shows the potential problem on line 330

In my opinion, the code should be fixed in order to be able to leave out the extra space character. If you would create a 'fix' for this option in common.inc.php, you might end up make these fixes for a lot of options...

**Comment posted by madman on 25 Jul 2010 21:46** I already checked for it with a normal install. With a Linux system this is quiet easy to do: grep -Rn order_by \* | grep conf | grep -v &quot;.svn&quot; I don&#039;t know if you are familiar with Linux, but this searches all files recursively for the words &quot;order_by&quot; and &quot;conf&quot;, but leaves out all files that come with svn (I use a svn checkout, not an svn export). The output looks like this: admin/element_set_unit.php:199: &#039;.$conf[&#039;order_by&#039;].&#039; admin/element_set_global.php:454: &#039;.$conf[&#039;order_by&#039;].&#039; include/ws_functions.inc.php:285: $order_by = empty($order_by) ? $conf[&#039;order_by&#039;] : &#039;ORDER BY &#039;.$order_by; include/ws_functions.inc.php:817: $conf[&#039;order_by&#039;] = &#039;ORDER BY &#039;.$order_by; include/ws_functions.inc.php:1489: $order_by = $conf[&#039;order_by&#039;]; include/section_init.inc.php:176: $conf[&#039;order_by&#039;] = $conf[&#039;order_by_inside_category&#039;]; include/section_init.inc.php:192: $conf[&#039;order_by&#039;] = str_replace( include/section_init.inc.php:195: $conf[&#039;order_by&#039;] include/section_init.inc.php:251: $conf[ &#039;order_by&#039; ] = &#039; ORDER BY &#039;.$page[&#039;category&#039;][&#039;image_order&#039;]; include/section_init.inc.php:298: &#039;.$conf[&#039;order_by&#039;].&#039; include/section_init.inc.php:330: $conf[&#039;order_by&#039;].&#039; include/section_init.inc.php:403: &#039;.$conf[&#039;order_by&#039;].&#039; include/section_init.inc.php:433: $conf[&#039;order_by&#039;] = str_replace( include/section_init.inc.php:436: $conf[&#039;order_by&#039;] include/section_init.inc.php:447: &#039;.$conf[&#039;order_by&#039;].&#039; include/section_init.inc.php:477: $conf[&#039;order_by&#039;] = &#039; ORDER BY hit DESC, file ASC&#039;; include/section_init.inc.php:484: &#039;.$conf[&#039;order_by&#039;].&#039; include/section_init.inc.php:503: $conf[&#039;order_by&#039;] = &#039; ORDER BY average_rate DESC, id ASC&#039;; include/section_init.inc.php:511: &#039;.$conf[&#039;order_by&#039;].&#039; include/section_init.inc.php:534: &#039;.$conf[&#039;order_by&#039;].&#039; include/functions_search.inc.php:237: &#039;.$conf[&#039;order_by&#039;]; include/functions_search.inc.php:284: &#039;.$conf[&#039;order_by&#039;]; include/functions_search.inc.php:564: $conf[&#039;order_by&#039;]; include/functions_calendar.inc.php:267: &#039;.$conf[&#039;order_by&#039;]; include/functions_calendar.inc.php:282: &#039;ORDER BY &#039;.$calendar-&gt;date_field.$order, $conf[&#039;order_by&#039;] include/config_default.inc.php:46:// order_by : how to change the order of display for images in a category ? include/config_default.inc.php:58:// 1. $conf[&#039;order_by&#039;] = &quot; order by date_available desc, file asc&quot;; include/config_default.inc.php:61:// 2. $conf[&#039;order_by&#039;] = &quot; order by file asc&quot;; include/config_default.inc.php:64:$conf[&#039;order_by&#039;] = &#039; ORDER BY date_available DESC, file ASC, id ASC&#039;; include/config_default.inc.php:66:// order_by_inside_category : inside a category, images can also be ordered include/config_default.inc.php:72:// $conf[&#039;order_by_inside_category&#039;] = &#039; ORDER BY rank&#039;; include/config_default.inc.php:74:$conf[&#039;order_by_inside_category&#039;] = $conf[&#039;order_by&#039;]; Here it is easy to see that these need further inspection: include/section_init.inc.php:195: $conf[&#039;order_by&#039;] include/section_init.inc.php:330: $conf[&#039;order_by&#039;].&#039; include/section_init.inc.php:436: $conf[&#039;order_by&#039;] include/functions_search.inc.php:564: $conf[&#039;order_by&#039;]; Inspecting the code shows the potential problem on line 330 In my opinion, the code should be fixed in order to be able to leave out the extra space character. If you would create a &#039;fix&#039; for this option in common.inc.php, you might end up make these fixes for a lot of options... <!-- github-comment-id:124892125 -->
Author
Owner

Comment posted by plg on 25 Jul 2010 22:29

madman wrote:

> I don't know if you are familiar with Linux [...]

I am. My main operating system has been a Debian then Ubuntu since 2002. I use command line a lot (and I prefer the "find | xargs grep" method than "grep -R") and Emacs for coding :-) But anyway, several Piwigo core developpers are not using Linux and your details will be useful for them if they read this issue, so thank you.

> In my opinion, the code should be fixed in order to be able
> to leave out the extra space character. If you would create
> a 'fix' for this option in common.inc.php, you might end up
> make these fixes for a lot of options...

Ok, I'll do it the way you propose. Your points have sense :-)

**Comment posted by plg on 25 Jul 2010 22:29** madman wrote: &gt; I don&#039;t know if you are familiar with Linux [...] I am. My main operating system has been a Debian then Ubuntu since 2002. I use command line a lot (and I prefer the &quot;find | xargs grep&quot; method than &quot;grep -R&quot;) and Emacs for coding :-) But anyway, several Piwigo core developpers are not using Linux and your details will be useful for them if they read this issue, so thank you. &gt; In my opinion, the code should be fixed in order to be able &gt; to leave out the extra space character. If you would create &gt; a &#039;fix&#039; for this option in common.inc.php, you might end up &gt; make these fixes for a lot of options... Ok, I&#039;ll do it the way you propose. Your points have sense :-) <!-- github-comment-id:124892136 -->
Sign in to join this conversation.
No labels
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/Piwigo#135