fix: DB:rawを使っているため危険な処理を削除し、Prepaired Statementに変更

thinkingreed-inc · Nov 1, 2023 · 0341c76 · 0341c76
1 parent 284e9cf
commit 0341c76
Show file tree

Hide file tree

Showing 4 changed files with 32 additions and 16 deletions.
diff --git a/app/Console/Commands/SendMailReminder.php b/app/Console/Commands/SendMailReminder.php
@@ -110,19 +110,23 @@ private function getScheduleReminders(){
 
         $notifications = $query->get();
 
-        //繰り返し予定の抽出
-        $recurrings = Recurring::with(['schedule','schedule.attendees'])
-            ->join('schedules', 'recurrings.schedule_id', '=', 'schedules.id')
-            ->where('recurrings.deleted','=',false)
-            ->where('recurrings.start_date', '<=', $nowDatetime)
-            ->where('recurrings.end_date', '>=', \DB::raw("DATE_SUB('".$nowDatetime."', INTERVAL TIMESTAMPDIFF(DAY,schedules.start_date,schedules.end_date) DAY)"))// カレンダーの開始日から予定の期間（日）を引いた日付が終了日以下の場合
-            ->get();
-
         $activeStartFormatted = new DateTime($nowDatetime);
         $activeStartFormatted->format('Y-m-d');
         $activeEndFormatted = new DateTime($nowDatetime);
         $activeEndFormatted->format('Y-m-d');
 
+        //繰り返し予定の抽出
+        $recurrings = Recurring::with(['schedule','schedule.attendees'])
+        ->join('schedules', 'recurrings.schedule_id', '=', 'schedules.id')
+        ->where('recurrings.deleted','=',false)
+        ->where('recurrings.start_date', '<=', $nowDatetime)
+        // カレンダーの開始日から予定の期間（日）を引いた日付が終了日以下の場合
+        ->whereRaw(
+            'recurrings.end_date >= DATE_SUB(?, INTERVAL TIMESTAMPDIFF(DAY, schedules.start_date, schedules.end_date) DAY)', 
+            [$activeStartFormatted]
+        )
+        ->get();
+
         $transformer = new \Recurr\Transformer\ArrayTransformer();
         $transformerConfig = new \Recurr\Transformer\ArrayTransformerConfig();
         $transformerConfig->enableLastDayOfMonthFix();

diff --git a/app/Http/Controllers/HolidayController.php b/app/Http/Controllers/HolidayController.php
@@ -30,7 +30,11 @@ public function index(Request $request)
 
         $query = Holiday::select('*');
         if( strlen($search) > 0 ) {
-            $query->where(\DB::raw("CONCAT(summary, ',', holiday)"), 'LIKE', "%{$search}%");
+            $searchTerm = "%{$search}%";
+            $query->whereRaw(
+                "CONCAT(summary, ',', holiday) LIKE ?", 
+                [$searchTerm]
+            );
         }
         $holidayYear = $request->get("holiday_year");
         if(!empty($holidayYear)) {

diff --git a/app/Http/Controllers/ScheduleController.php b/app/Http/Controllers/ScheduleController.php
@@ -119,19 +119,23 @@ private function getSchedules($viewType, $activeStart, $activeEnd, $user_ids, $m
 
         $event_arrays= [];
 
+        $activeStartFormatted = new DateTime($activeStart);
+        $activeStartFormatted->format('Y-m-d');
+        $activeEndFormatted = new DateTime($activeEnd);
+        $activeEndFormatted->format('Y-m-d');
+
         //繰り返し予定の抽出
         $recurrings = Recurring::with(['schedule','schedule.attendees'])
             ->join('schedules', 'recurrings.schedule_id', '=', 'schedules.id')
             ->where('recurrings.deleted','=',false)
             ->where('recurrings.start_date', '<=', $activeEnd)
-            ->where('recurrings.end_date', '>=', \DB::raw("DATE_SUB('".$activeStart."', INTERVAL TIMESTAMPDIFF(DAY,schedules.start_date,schedules.end_date) DAY)"))// カレンダーの開始日から予定の期間（日）を引いた日付が終了日以下の場合
+            // カレンダーの開始日から予定の期間（日）を引いた日付が終了日以下の場合
+            ->whereRaw(
+                'recurrings.end_date >= DATE_SUB(?, INTERVAL TIMESTAMPDIFF(DAY, schedules.start_date, schedules.end_date) DAY)', 
+                [$activeStartFormatted]
+            )
             ->get();
 
-        $activeStartFormatted = new DateTime($activeStart);
-        $activeStartFormatted->format('Y-m-d');
-        $activeEndFormatted = new DateTime($activeEnd);
-        $activeEndFormatted->format('Y-m-d');
-
         //繰り返し予定をRRuleに従い展開
         //parent_idとparent_uidを割り振り3次元配列に格納
         foreach ($recurrings as $key => $recurring){

diff --git a/app/Http/Controllers/UserController.php b/app/Http/Controllers/UserController.php
@@ -60,7 +60,11 @@ public function index(Request $request){
 
             $query = User::select('users.*');
             if( strlen($search) > 0 ) {
-                $query->where(\DB::raw("CONCAT(lastname, ',', IFNULL(firstname,''), ',', IFNULL(email,'') )"), 'LIKE', "%{$search}%");
+                $searchTerm = "%{$search}%";
+                $query->whereRaw(
+                    "CONCAT(lastname, ',', IFNULL(firstname, ''), ',', IFNULL(email, '') ) LIKE ?", 
+                    [$searchTerm]
+                );
             }
             if( strlen($sortBy) > 0 ) {
                 $query->orderBy($sortBy, $sortStr);