russell@unturf.com
fc7fdad2dc
suitecrm-0004: SugarBean.php subpanel union field dedup in_array($field, $all_fields) inside nested foreach over subpanel queries — O(S*F^2), 4.3x at S=40 F=60. Fix: parallel hash set for O(1) isset() check. dolibarr-0004: emailcollector_card.php line 575 — IMAP password logged verbatim unconditionally in dol_syslog(). CWE-312 HIGH. Fix: replace with literal ***. dolibarr-0005: functions_ldap.php line 98 — LDAP admin searchPassword first 3 chars leaked via dol_trunc() in dol_syslog() and browser print when $ldapdebug=true. CWE-312 MEDIUM. Fix: replace dol_trunc(...) with literal *** in both sinks. All 4 SuiteCRM tests PASS. All 5 Dolibarr tests PASS. MOADs 0002/0003/0005 CLEAN for both targets (PHP single-threaded, architectural globals).
19 lines
1,004 B
Diff
19 lines
1,004 B
Diff
--- a/data/SugarBean.php
|
|
+++ b/data/SugarBean.php
|
|
@@ -883,12 +883,13 @@
|
|
//If final_query is still empty, its time to build the sub-queries
|
|
if (empty($final_query)) {
|
|
$subqueries = SugarBean::build_sub_queries_for_union($subpanel_list, $subpanel_def, $parentbean, $order_by);
|
|
$all_fields = array();
|
|
+ $all_fields_set = array(); // O(1) lookup instead of O(N) in_array
|
|
foreach ($subqueries as $i => $subquery) {
|
|
$query_fields = DBManagerFactory::getInstance()->getSelectFieldsFromQuery($subquery['select']);
|
|
foreach ($query_fields as $field => $select) {
|
|
- if (!in_array($field, $all_fields)) {
|
|
+ if (!isset($all_fields_set[$field])) {
|
|
$all_fields[] = $field;
|
|
+ $all_fields_set[$field] = true;
|
|
}
|
|
}
|
|
$subqueries[$i]['query_fields'] = $query_fields;
|
|
}
|