In the function user_admin_access_add(), the variable $aid is inserted into the access table.

function user_admin_access_add($mask = NULL, $type = NULL) {
  if ($edit = $_POST) {
    if (!$edit['mask']) {
      form_set_error('mask', t('You must enter a mask.'));
    }
    else {
      db_query("INSERT INTO {access} (aid, mask, type, status) VALUES ('%s', '%s', '%s', %d)", $aid, $edit['mask'], $edit['type'], $edit['status']);
      $aid = db_last_insert_id('access', 'aid');
      drupal_set_message(t('The access rule has been added.'));
      drupal_goto('admin/user/rules');
    }
  }
  else {
    $edit['mask'] = $mask;
    $edit['type'] = $type;
  }
  return drupal_get_form('user_admin_access_add_form', $edit, t('Add rule'));
}

However, the variable $aid is only initialised after the insert to the DB - should this be before the insert?

If it should be before the insert, please find the relevant patch.

CommentFileSizeAuthor
#1 user_85.patch724 bytespaddy_deburca
user_84.patch748 bytespaddy_deburca

Comments

paddy_deburca’s picture

paddy_deburca commented
StatusFileSize
new user_85.patch724 bytes

I have just checked further. As $aid is not declared, the value of ' aid' in the table is auto-incremented.

It may be better practice to not pass the undeclared value and remove ' aid' completely from the insert statement.

The attached patch ignores the one previously posted and removes ' aid' from the insert.

paddy_deburca’s picture

paddy_deburca commented
Title: in function user_admin_access_add() variable $aid is defined after insert to table - not before » in function user_admin_access_add() variable $aid is not defined before insert to table
Priority: Normal » Minor

I am updating the title and re-assigning this to minor as there is nothing broken.

To precise, I think that the insert statement should be 

db_query("INSERT INTO {access} (mask, type, status) VALUES ('%s', '%s', %d)", $edit['mask'], $edit['type'], $edit['status']);

rather than passing an undeclared and uninitialised variable $aid' into an auto-increment column.

dpearcefl’s picture

dpearcefl commented

Is there any interest in this issue any more?

paddy_deburca’s picture

paddy_deburca commented
Status: Active » Closed (cannot reproduce)

No. No longer an issue.