querystring ORDER BY not working with multiple elements

[sitfrog]

Hello all,
I am developing league scoring system with Fabrik and ran into a problem trying to sort lists when using the querystring in the URL and multiple columns. When I sort on one column, it works. When I try to sort using multiple columns, it gives me a 500 error. The SQL that is being dumped to the browser shows something interesting. The comma I used to delimit the two element names seems to be getting lost and the SQL statement in the ORDER BY clause concatenates the two elements into one non-existent element name.

This is my first post I'm not able to post links yet. I append these strings to my URL:

Works - ?&order_by=mdbteam_teamrecords___total_points_editable

Works - ?&order_by=mdbteam_teamrecords___wins_editable

Fails - ?&order_by=mdbteam_teamrecords___wins_editable,mdbteam_teamrecords___total_points_editable

The one that fails has this in the clause, the wins_editable element gets merged with the total_points_editable. I assume I am creating the URL incorrectly, I have tried all kinds of subtle variations but I get the same results:
ORDER BY `mdbteam_teamrecords`.`wins_editablemdbteam_teamrecords`.`total_points_editable` DESC,`mdbteam_teamrecords`.`wins_editable` DESC LIMIT 0, 30

Any ideas?
Matt

 

[troester]

Where do you create the URL?
Did you try with a HTMLencoded ,?

 

[sitfrog]

I create it in the browser URL address bar. Have not tried that HTML Encoding. Will do that today and let you know.

 

[troester]

Seems to be a bug
https://github.com/Fabrik/fabrik/issues/1247

 

[cheesegrits]

I'm testing a fix locally. As per your issue comment, yes, using getString() does have implications, as it doesn't sanitize. That's OK for the order_by, as we have to match the element names given against element names on the table, so any injected SQL would just get ignored. But for the order_dir, we'll have to sanitize the input.

I've got what I think is a safe fix, just want to test it for a day before committing it.

-- hugh

 

[rackem]

Any updates on this?

 

[rackem]

*friendly bump*

 

[troester]

Did you try?
It's working in my Fabrik3.2 site.

 

[rackem]

Sorry, my bad, please ignore. I got this thread confused with another.

 

[cheesegrits]

Happens to me all the time.

-- hugh