{"action":"created","issue":{"url":"https://api.github.com/repos/joomla/joomla-cms/issues/7625","labels_url":"https://api.github.com/repos/joomla/joomla-cms/issues/7625/labels{/name}","comments_url":"https://api.github.com/repos/joomla/joomla-cms/issues/7625/comments","events_url":"https://api.github.com/repos/joomla/joomla-cms/issues/7625/events","html_url":"https://github.com/joomla/joomla-cms/issues/7625","id":98873823,"number":7625,"title":"SQL statements from Article Body are EXECUTED when displaying Category List containing the Articles","user":{"login":"jarea1050","id":13633611,"avatar_url":"https://avatars.githubusercontent.com/u/13633611?v=3","gravatar_id":"","url":"https://api.github.com/users/jarea1050","html_url":"https://github.com/jarea1050","followers_url":"https://api.github.com/users/jarea1050/followers","following_url":"https://api.github.com/users/jarea1050/following{/other_user}","gists_url":"https://api.github.com/users/jarea1050/gists{/gist_id}","starred_url":"https://api.github.com/users/jarea1050/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jarea1050/subscriptions","organizations_url":"https://api.github.com/users/jarea1050/orgs","repos_url":"https://api.github.com/users/jarea1050/repos","events_url":"https://api.github.com/users/jarea1050/events{/privacy}","received_events_url":"https://api.github.com/users/jarea1050/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/joomla/joomla-cms/labels/No%20Code%20Attached%20Yet","name":"No Code Attached Yet","color":"ededed"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":7,"created_at":"2015-08-04T02:07:32Z","updated_at":"2015-08-04T15:39:39Z","closed_at":"2015-08-04T05:59:01Z","body":"#### Steps to reproduce the issue\r\nThis has been tested using both Sorcerer and DirectPHP to embed php (and thus SQL) code in the body of an article. Same effect with either plug-in.\r\n\r\n1) Place SQL code (preferably an Insert, but Select works as well) in an Article body, execute the Article and confirm that the SQL works.\r\n2) Place the Article in a Category and place the Category List in a Menu item.\r\n3) Display the menu.\r\n\r\n\r\n#### Expected result\r\nSimple listing of the Category items.\r\n\r\n\r\n\r\n#### Actual result\r\nSimple listing of the Category items AND\r\nAll of the SQL statements that are embedded in the Articles that are included in the Category list will be EXECUTED when the Category List is displayed!!!\r\n\r\n\r\n#### System information (as much as possible)\r\nJoomla 3.43\r\nSourcerer 5.0.0\r\nPHP 5.4.42\r\nMySQL 5.5.42\r\n\r\n\r\n#### Additional comments\r\nSQL Statement in 1st Article Body (Test Select)(encapsulated in Sourcerer tags)\r\n\r\n```\r\n{source}<?php\r\n//$db = JFactory::getDbo(); / JFactory is not necessary with Sourcerer - it automatically creates the $db object\r\n$query = $db->getQuery(true);\r\n\r\n$query->select($db->quoteName(id));\r\n$query->from($db->quoteName('test'));\r\n$query->order('id DESC');\r\n$query->setLimit('1');\r\n\r\n$db->setQuery($query);\r\n$results = $db->loadResult();\r\n\r\nvar_dump($results);\r\necho \"<br>ID is: \" . $results;\r\necho \"<br>New ID is: \" . $results += 1;\r\n?>{/source}\r\n```\r\n\r\nAlternatively, you can do a file include with the same effect.\r\n\r\nSQL Statement in 2nd Article Body (Test Insert)\r\n\r\n```\r\n{source}<?php\r\n\r\n// Test - insert a record into test table (id date_time text) not part of Fabrik universe\r\n\r\n$date = JFactory::getDate();\r\n\r\n// Get a db connection.\r\n$db= JFactory::getDbo();\r\n\r\n// Create a new query object.\r\n$query = $db->getQuery(true);\r\n\r\n// Determine the value for the next record\r\n\r\n$columns = array('date_time', 'element');\r\n\r\n$values = array($db->quote($date), $db->quote(\"sample text\"));\r\n\r\n\r\n// Build the query\r\n\r\n$query\r\n\r\n     ->insert($db->quoteName('test'))\r\n\r\n     ->columns($db->quoteName($columns))\r\n\r\n     ->values(implode(',', $values));\r\n\r\n \r\n\r\n// Execute the query\r\n\r\n$db->setQuery($query);\r\n\r\n$db->execute();\r\n\r\necho '<h3><p style=\"text-align:center\">Your submission to the TEST table  has been received. <br>Thank you for helping out!</p></h3>';\r\n\r\n?>{/source}\r\n```\r\nDisplay the Category List (in Debug Mode)\r\n```\r\n**Title**\t\t**Author**\t\t**Hits**\t\r\nTest Insert \t**Written by Super User** \t**Hits: 9**\r\nTest Select \t**Written by Super User** \t**Hits: 38**\r\n```\r\nSelected SQL statements from display of Category List\r\n\r\n```\r\n**Query Time: 0.41 ms** **After last query: 14.63 ms**\r\n\r\nINSERT INTO `test`\r\n(`date_time`,`element`) \r\n  VALUES \r\n('2015-08-04 01:14:39','sample text')\r\n\r\n**Explain**\r\n**EXPLAIN not possible on query: INSERT INTO `test` (`date_time`,`element`) VALUES ('2015-08-04 01:14:39','sample text')**\r\n**Profile**\r\n**No SHOW PROFILE (maybe because there are more than 100 queries)**\r\n**Call Stack**\r\nJROOT/plugins/content/DirectPHP/DirectPHP.php(58) : eval()'d code:51\r\nJROOT/plugins/content/DirectPHP/DirectPHP.php:58\r\nJROOT/libraries/joomla/event/event.php:69\r\nJROOT/libraries/joomla/event/dispatcher.php:160\r\nJROOT/components/com_content/views/category/view.html.php:106\r\nJROOT/libraries/legacy/controller/legacy.php:690\r\nJROOT/components/com_content/controller.php:104\r\nJROOT/libraries/legacy/controller/legacy.php:728\r\nJROOT/components/com_content/content.php:16\r\nJROOT/libraries/cms/component/helper.php:392\r\nJROOT/libraries/cms/component/helper.php:372\r\nJROOT/libraries/cms/application/site.php:191\r\nJROOT/libraries/cms/application/site.php:230\r\nJROOT/libraries/cms/application/cms.php:252\r\nJROOT/index.php:45\r\n[**Add xdebug.file_link_format directive to your php.ini file to have links for files.**]\r\n**Query Time: 0.20 ms** **After last query: 1.95 ms**\r\n\r\nSELECT `id`\r\n\r\n  FROM `test`\r\n\r\n  ORDER BY id DESC \r\n  LIMIT 0, 1\r\n\r\n**Explain**\r\nid\tselect_type\ttable\ttype\tpossible_keys\tkey\tkey_len\tref\trows\tExtra\r\n1\tSIMPLE\ttest\tindex\tNULL\tPRIMARY\t4\tNULL\t1\tUsing index\r\n**Profile**\r\n**No SHOW PROFILE (maybe because there are more than 100 queries)**\r\n**Call Stack**\r\nJROOT/includes/test_select.php:15\r\nJROOT/plugins/content/DirectPHP/DirectPHP.php(58) : eval()'d code:1\r\nJROOT/plugins/content/DirectPHP/DirectPHP.php:58\r\nJROOT/libraries/joomla/event/event.php:69\r\nJROOT/libraries/joomla/event/dispatcher.php:160\r\nJROOT/components/com_content/views/category/view.html.php:106\r\nJROOT/libraries/legacy/controller/legacy.php:690\r\nJROOT/components/com_content/controller.php:104\r\nJROOT/libraries/legacy/controller/legacy.php:728\r\nJROOT/components/com_content/content.php:16\r\nJROOT/libraries/cms/component/helper.php:392\r\nJROOT/libraries/cms/component/helper.php:372\r\nJROOT/libraries/cms/application/site.php:191\r\nJROOT/libraries/cms/application/site.php:230\r\nJROOT/libraries/cms/application/cms.php:252\r\nJROOT/index.php:45\r\n```\r\n\r\nNote: there is a workaround for the end user until this gets fixed.  Have an Article listed in the Category (NSN) with a call to the Article containing the SQL statements.  Place the Articles containing the SQL code in a different Category (nsn-code) which (hopefully) never gets listed.\r\n\r\n```\r\n<?php\r\n// Calling Article in NSN Category\r\n\r\necho \"\r\n      window.open( 'http://localhost:8888/joomla_test/index.php/nsn-code/72-test-insert', '_self');\r\n   </script>\r\n\";\r\n\r\n?>\r\n```"},"comment":{"url":"https://api.github.com/repos/joomla/joomla-cms/issues/comments/127653399","html_url":"https://github.com/joomla/joomla-cms/issues/7625#issuecomment-127653399","issue_url":"https://api.github.com/repos/joomla/joomla-cms/issues/7625","id":127653399,"user":{"login":"mbabker","id":368545,"avatar_url":"https://avatars.githubusercontent.com/u/368545?v=3","gravatar_id":"","url":"https://api.github.com/users/mbabker","html_url":"https://github.com/mbabker","followers_url":"https://api.github.com/users/mbabker/followers","following_url":"https://api.github.com/users/mbabker/following{/other_user}","gists_url":"https://api.github.com/users/mbabker/gists{/gist_id}","starred_url":"https://api.github.com/users/mbabker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mbabker/subscriptions","organizations_url":"https://api.github.com/users/mbabker/orgs","repos_url":"https://api.github.com/users/mbabker/repos","events_url":"https://api.github.com/users/mbabker/events{/privacy}","received_events_url":"https://api.github.com/users/mbabker/received_events","type":"User","site_admin":false},"created_at":"2015-08-04T15:39:39Z","updated_at":"2015-08-04T15:39:39Z","body":"If the behavior can be reproduced with the core platform (no third party plugins), then with a good set of instructions on how to recreate the issue, it can be resolved.\r\n\r\nIf enabling a third party plugin alters the expected output, and it can be traced to the plugin as giving the unwanted behavior, the issue must be addressed by the third party plugin.\r\n\r\nAs much as I agree you're seeing behavior that isn't what you expect, the bug that you are seeing is one that is a result of a third party's action and cannot be resolved by the core platform.  Because of how data objects are passed into the various plugin events, it is entirely possible for plugins to override certain data, add extra data, or remove it completely.  Without proper checks in plugin code, it can have very unwelcome side effects; I know this first hand developing plugins and having to make them work not only with core but other plugins.  It's a side effect of having such a powerful plugin system."}}