From 5b57289a50da18991d90e0eed169899d79b3f8b7 Mon Sep 17 00:00:00 2001 From: Dillard Blom Date: Sat, 11 Jul 2026 05:04:51 +0200 Subject: [PATCH] Fix owner-scope query bug returning the wrong qr code by id qr_apply_owner_scope() used where('id_owner', X) + orWhere('id_owner', NULL, 'IS'). Any caller that had already added its own where('id', $id) before calling it (qrcode_image.php, bulk_action.php's download path) ended up with "WHERE id = ? AND id_owner = ? OR id_owner IS NULL" - AND binds tighter than OR in SQL, so this was actually "(id = ? AND id_owner = ?) OR (id_owner IS NULL)", which silently detaches the id filter and returns an arbitrary null-owner row instead (or nothing, if that row's file is missing) whenever the intended row didn't have a null owner. This is what broke qr code thumbnails/downloads on qr.ensembia.com for scoped (non-super) accounts, old and newly-created codes alike - reproduced and confirmed fixed with a local before/after query dump, then with a live HTTP request scenario (two accounts, two codes, one null-owner). Fixed by building the scope as a single parenthesized raw condition instead of two separate where() calls, so it can't be split apart by whatever the caller already added to the query. Also this session, per user feedback on the OSS rebrand review: - Format moved back next to Filename in both qr-creation forms (was separated from it when Filename got grouped with Owner last session). - README/About now mention the temporary admin/admin demo account instead of the not-yet-built self-registration flow. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01Fo3DiRRpmz2DXjD7Uzhc8u --- README.md | 3 ++- src/about.php | 3 ++- src/forms/form_dynamic_add.php | 24 ++++++++++++------------ src/forms/qrcode_options.php | 34 +++++++++++++++++----------------- src/includes/security.php | 10 ++++++++-- 5 files changed, 41 insertions(+), 33 deletions(-) diff --git a/README.md b/README.md index 40b2e37..9667115 100644 --- a/README.md +++ b/README.md @@ -8,7 +8,8 @@ of the original [PHP Dynamic Qr code](https://github.com/giandonatoinverso/PHP-D project by Giandonato Inverso, built on [AdminLTE](https://adminlte.io/). - **Try it free:** [qr.ensembia.com](https://qr.ensembia.com) - fully functional OSS test - instance, register your own account any time. + instance. Self-service signup isn't live yet, so log in with the temporary shared demo + account `admin` / `admin` in the meantime. - **Commercial VIP edition** (self-service create-rights, logo-embedded QR codes): [www.qrforge.eu](https://www.qrforge.eu). - **Self-host it yourself:** this repository, MIT-licensed. diff --git a/src/about.php b/src/about.php index 697a10f..e3d667b 100644 --- a/src/about.php +++ b/src/about.php @@ -51,7 +51,8 @@ require_once BASE_PATH . '/includes/auth_validate.php'; This is the free, open-source (MIT) edition of QRForge. It runs unmodified as a live, fully functional try-out at qr.ensembia.com - - register a free account there any time. + self-service signup isn't live yet, so log in with the temporary shared + demo account admin / admin in the meantime.

The commercial VIP edition (paid create-rights and logo-embedded QR codes) diff --git a/src/forms/form_dynamic_add.php b/src/forms/form_dynamic_add.php index 19e9ea8..981e3c6 100644 --- a/src/forms/form_dynamic_add.php +++ b/src/forms/form_dynamic_add.php @@ -118,18 +118,6 @@

-
- - -
-
@@ -178,6 +166,18 @@
+
+ + +
+
diff --git a/src/forms/qrcode_options.php b/src/forms/qrcode_options.php index 979e77e..32fd433 100644 --- a/src/forms/qrcode_options.php +++ b/src/forms/qrcode_options.php @@ -114,23 +114,6 @@ if (QRCODE_GENERATOR === "internal-chillerlan.qrcode") {
-
- - -
-
@@ -179,6 +162,23 @@ if (QRCODE_GENERATOR === "internal-chillerlan.qrcode") {
+
+ + +
+
diff --git a/src/includes/security.php b/src/includes/security.php index 31e5c40..80f054b 100644 --- a/src/includes/security.php +++ b/src/includes/security.php @@ -177,12 +177,18 @@ function qr_has_full_visibility() { /** * Apply the current session's owner scope to a MysqliDb query builder in place. * No-op when the session has full visibility. + * + * Uses a single raw, parenthesized condition rather than where()+orWhere() - + * the previous two-call form produced "WHERE id = ? AND id_owner = ? OR id_owner + * IS NULL" whenever a caller had already added its own where('id', ...) (e.g. + * qrcode_image.php, bulk_action.php), and AND binds tighter than OR in SQL, so + * the OR silently detached from the id filter and matched *any* id_owner-NULL + * row instead of the one actually requested. */ function qr_apply_owner_scope($db) { $scope_owner_id = qr_scope_owner_id(); if ($scope_owner_id !== null) { - $db->where('id_owner', $scope_owner_id); - $db->orWhere('id_owner', NULL, 'IS'); + $db->where('(id_owner = ' . (int) $scope_owner_id . ' OR id_owner IS NULL)'); } }