Browse Source

Ensure that fields in orderAsc/orderDesc are quoted.

String fields should be quoted when used with orderDesc/orderAsc.
Mark Story 10 years ago
parent
commit
80908ec778

+ 4 - 7
src/Database/Expression/OrderClauseExpression.php

@@ -15,6 +15,8 @@
 namespace Cake\Database\Expression;
 
 use Cake\Database\ExpressionInterface;
+use Cake\Database\Expression\FieldInterface;
+use Cake\Database\Expression\FieldTrait;
 use Cake\Database\ValueBinder;
 
 /**
@@ -22,14 +24,9 @@ use Cake\Database\ValueBinder;
  *
  * @internal
  */
-class OrderClauseExpression implements ExpressionInterface
+class OrderClauseExpression implements ExpressionInterface, FieldInterface
 {
-    /**
-     * The field being sorted on.
-     *
-     * @var \Cake\Database\ExpressionInterface|string
-     */
-    protected $_field;
+    use FieldTrait;
 
     /**
      * The direction of sorting.

+ 13 - 0
tests/TestCase/Database/QueryTest.php

@@ -1504,6 +1504,8 @@ class QueryTest extends TestCase
         $query->select(['id'])
             ->from('articles')
             ->orderAsc('id');
+
+        $sql = $query->sql();
         $result = $query->execute()->fetchAll('assoc');
         $expected = [
             ['id' => 1],
@@ -1511,6 +1513,11 @@ class QueryTest extends TestCase
             ['id' => 3],
         ];
         $this->assertEquals($expected, $result);
+        $this->assertQuotedQuery(
+            'SELECT <id> FROM <articles> ORDER BY <id> ASC',
+            $sql,
+            !$this->autoQuote
+        );
 
         $query = new Query($this->connection);
         $query->select(['id'])
@@ -1537,6 +1544,7 @@ class QueryTest extends TestCase
         $query->select(['id'])
             ->from('articles')
             ->orderDesc('id');
+        $sql = $query->sql();
         $result = $query->execute()->fetchAll('assoc');
         $expected = [
             ['id' => 3],
@@ -1544,6 +1552,11 @@ class QueryTest extends TestCase
             ['id' => 1],
         ];
         $this->assertEquals($expected, $result);
+        $this->assertQuotedQuery(
+            'SELECT <id> FROM <articles> ORDER BY <id> DESC',
+            $sql,
+            !$this->autoQuote
+        );
 
         $query = new Query($this->connection);
         $query->select(['id'])