MDL-29295 do not use strtok in dml and ddl layers

This prevents clobbering of internal pointer when code calling DML
uses strtok too. Unit test added to prevent future uses.

diff --git a/lib/ddl/mssql_sql_generator.php b/lib/ddl/mssql_sql_generator.php
index 2067a44..3c9b41d 100644 (file)
--- a/lib/ddl/mssql_sql_generator.php
+++ b/lib/ddl/mssql_sql_generator.php
@@ -298,7 +298,7 @@ class mssql_sql_generator extends sql_generator {
         $oldlength = $metac->max_length;
         $olddecimals = empty($metac->scale) ? null : $metac->scale;
         $oldnotnull = empty($metac->not_null) ? false : $metac->not_null;
-        $olddefault = empty($metac->has_default) ? null : strtok($metac->default_value, ':');
+        //$olddefault = empty($metac->has_default) ? null : strtok($metac->default_value, ':');
 
         $typechanged = true;  //By default, assume that the column type has changed
         $lengthchanged = true;  //By default, assume that the column length has changed

diff --git a/lib/dml/mssql_native_moodle_database.php b/lib/dml/mssql_native_moodle_database.php
index bf28990..5b32ad2 100644 (file)
--- a/lib/dml/mssql_native_moodle_database.php
+++ b/lib/dml/mssql_native_moodle_database.php
@@ -615,7 +615,8 @@ class mssql_native_moodle_database extends moodle_database {
             return $sql;
         }
         /// ok, we have verified sql statement with ? and correct number of params
-        $return = strtok($sql, '?');
+        $parts = explode('?', $sql);
+        $return = array_shift($parts);
         foreach ($params as $param) {
             if (is_bool($param)) {
                 $return .= (int)$param;
@@ -640,7 +641,7 @@ class mssql_native_moodle_database extends moodle_database {
                 $return .= "N'$param'";
             }
 
-            $return .= strtok('?');
+            $return .= array_shift($parts);
         }
         return $return;
     }

diff --git a/lib/dml/mysqli_native_moodle_database.php b/lib/dml/mysqli_native_moodle_database.php
index d2693bf..165adae 100644 (file)
--- a/lib/dml/mysqli_native_moodle_database.php
+++ b/lib/dml/mysqli_native_moodle_database.php
@@ -666,7 +666,8 @@ class mysqli_native_moodle_database extends moodle_database {
             return $sql;
         }
         /// ok, we have verified sql statement with ? and correct number of params
-        $return = strtok($sql, '?');
+        $parts = explode('?', $sql);
+        $return = array_shift($parts);
         foreach ($params as $param) {
             if (is_bool($param)) {
                 $return .= (int)$param;
@@ -680,7 +681,7 @@ class mysqli_native_moodle_database extends moodle_database {
                 $param = $this->mysqli->real_escape_string($param);
                 $return .= "'$param'";
             }
-            $return .= strtok('?');
+            $return .= array_shift($parts);
         }
         return $return;
     }

diff --git a/lib/dml/simpletest/testdml.php b/lib/dml/simpletest/testdml.php
index c9114c9..f44e258 100644 (file)
--- a/lib/dml/simpletest/testdml.php
+++ b/lib/dml/simpletest/testdml.php
@@ -503,6 +503,28 @@ class dml_test extends UnitTestCase {
         $this->assertIdentical(array_values($params), array_values($inparams));
     }
 
+    public function test_strtok() {
+        // strtok was previously used by bound emulation, make sure it is not used any more
+        $DB = $this->tdb;
+        $dbman = $this->tdb->get_manager();
+
+        $table = $this->get_test_table();
+        $tablename = $table->getName();
+
+        $table->add_field('id', XMLDB_TYPE_INTEGER, '10', XMLDB_UNSIGNED, XMLDB_NOTNULL, XMLDB_SEQUENCE, null);
+        $table->add_field('course', XMLDB_TYPE_INTEGER, '10', XMLDB_UNSIGNED, XMLDB_NOTNULL, null, '0');
+        $table->add_field('name', XMLDB_TYPE_CHAR, '255', null, null, null, 'lala');
+        $table->add_key('primary', XMLDB_KEY_PRIMARY, array('id'));
+        $dbman->create_table($table);
+
+        $str = 'a?b?c?d';
+        $this->assertIdentical(strtok($str, '?'), 'a');
+
+        $DB->get_records($tablename, array('id'=>1));
+
+        $this->assertIdentical(strtok('?'), 'b');
+    }
+
     public function test_tweak_param_names() {
         // Note the tweak_param_names() method is only available in the oracle driver,
         // hence we look for expected results indirectly, by testing various DML methods

diff --git a/lib/dml/sqlsrv_native_moodle_database.php b/lib/dml/sqlsrv_native_moodle_database.php
index 805ab53..d71f4fa 100644 (file)
--- a/lib/dml/sqlsrv_native_moodle_database.php
+++ b/lib/dml/sqlsrv_native_moodle_database.php
@@ -696,8 +696,8 @@ class sqlsrv_native_moodle_database extends moodle_database {
             return $sql;
         }
         /// ok, we have verified sql statement with ? and correct number of params
-        $return = strtok($sql, '?');
-
+        $parts = explode('?', $sql);
+        $return = array_shift($parts);
         foreach ($params as $param) {
             if (is_bool($param)) {
                 $return .= (int)$param;
@@ -717,7 +717,7 @@ class sqlsrv_native_moodle_database extends moodle_database {
                 $return .= "N'$param'";
             }
 
-            $return .= strtok('?');
+            $return .= array_shift($parts);
         }
         return $return;
     }