From 87e88dacfd22d7aaa769761f796ce6a018ed7c01 Mon Sep 17 00:00:00 2001
From: Aaron Daniels <aaron@daniels.id.au>
Date: Thu, 14 Jan 2016 05:22:37 +1000
Subject: [PATCH] - Compress API filters to a loop - Check for filters for
 valid fields

---
 html/includes/api_functions.inc.php | 24 +++++-------------------
 includes/component.php              | 20 ++++++++++++--------
 2 files changed, 17 insertions(+), 27 deletions(-)

diff --git a/html/includes/api_functions.inc.php b/html/includes/api_functions.inc.php
index 0e50b65db..59527f843 100644
--- a/html/includes/api_functions.inc.php
+++ b/html/includes/api_functions.inc.php
@@ -519,29 +519,15 @@ function get_components() {
 
     // Do some filtering if the user requests.
     $options = array();
-    if (isset($_GET['type'])) {
-        // set a type = filter
-        $options['filter']['type'] = array('=',$_GET['type']);
-    }
-    if (isset($_GET['id'])) {
-        // set a id = filter
-        $options['filter']['id'] = array('=',$_GET['id']);
-    }
+    // We need to specify the label as this is a LIKE query
     if (isset($_GET['label'])) {
         // set a label like filter
         $options['filter']['label'] = array('LIKE',$_GET['label']);
+        unset ($_GET['label']);
     }
-    if (isset($_GET['status'])) {
-        // set a status = filter
-        $options['filter']['status'] = array('=',$_GET['status']);
-    }
-    if (isset($_GET['disabled'])) {
-        // set a disabled = filter
-        $options['filter']['disabled'] = array('=',$_GET['disabled']);
-    }
-    if (isset($_GET['ignore'])) {
-        // set a ignore = filter
-        $options['filter']['ignore'] = array('=',$_GET['ignore']);
+    // Add the rest of the options with an equals query
+    foreach ($_GET as $k) {
+        $options['filter'][$k] = array('=',$_GET[$k]);
     }
 
     // use hostname as device_id if it's all digits
diff --git a/includes/component.php b/includes/component.php
index ee5a93774..6808e847b 100644
--- a/includes/component.php
+++ b/includes/component.php
@@ -69,17 +69,21 @@ class component {
         $COUNT = 0;
         if (isset($options['filter'])) {
             $COUNT++;
+            $validFields = array('device_id','type','id','label','status','disabled','ignore','error');
             $SQL .= " ( ";
             foreach ($options['filter'] as $field => $array) {
-                if ($array[0] == 'LIKE') {
-                    $SQL .= "`".$field."` LIKE ? AND ";
-                    $array[1] = "%".$array[1]."%";
+                // Only add valid fields to the query
+                if (in_array($field,$validFields)) {
+                    if ($array[0] == 'LIKE') {
+                        $SQL .= "`".$field."` LIKE ? AND ";
+                        $array[1] = "%".$array[1]."%";
+                    }
+                    else {
+                        // Equals operator is the default
+                        $SQL .= "`".$field."` = ? AND ";
+                    }
+                    array_push($PARAM,$array[1]);
                 }
-                else {
-                    // Equals operator is the default
-                    $SQL .= "`".$field."` = ? AND ";
-                }
-                array_push($PARAM,$array[1]);
             }
             // Strip the last " AND " before closing the bracket.
             $SQL = substr($SQL,0,-5)." )";