Xavi/dodo
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Added bad input validation on task add

Browse Source
This commit is contained in:
xavi 2024-09-07 18:26:54 -07:00
parent 7a9d7e9ff0
commit 0113cec73c
1 changed files with 13 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
src/dodo.c
View File

@ -148,6 +148,8 @@ int display_task_list(int start_col, sqlite3 *db, char* colnames, char* table, c
if ( gen_sql_select_stmt(db, &out_stmt, colnames, table, status) ){
return -1;
}
// TODO: prob should be a func begin
// while there is still rows available
while ( rc = sqlite3_step(out_stmt) == SQLITE_ROW ){
// for each column print the column
@ -158,6 +160,7 @@ int display_task_list(int start_col, sqlite3 *db, char* colnames, char* table, c
}
// move down one and over to the start of the current task column
printf("\n");
// end
X_goright(start_col);
}
@ -184,7 +187,7 @@ int display_task_list(int start_col, sqlite3 *db, char* colnames, char* table, c
// pass in the args and return the title and due date
// due date passed as NULL if for delete
// TODO input validation for strings implement in strings!
int arg_parser(int argc, char** argv, char** title, char** due_date){
int parse_args(int argc, char** argv, char** title, char** due_date){
if ( argc > 1 ){
*title = argv[2];
}
@ -195,6 +198,8 @@ int arg_parser(int argc, char** argv, char** title, char** due_date){
}
// TODO: the way this ensures that we are only passing in
// valid inputs is stupid and ugly FIX
int add_task(sqlite3 *db, int argc, char** argv){
int rc = 0;
char* table = "tasks";
@ -204,9 +209,14 @@ int add_task(sqlite3 *db, int argc, char** argv){
char values[100];
sqlite3_stmt* out_stmt;
arg_parser(argc, argv, &title, &due_date);
parse_args(argc, argv, &title, &due_date);
snprintf(values, 100, "('%s', '%s')", title, due_date);
if ( due_date != NULL ){
snprintf(values, 100, "('%s', '%s')", title, due_date);
}else{
colnames = "(title)";
snprintf(values, 100, "('%s')", title);
}
if ( gen_sql_insert_stmt(db, &out_stmt, table, colnames, values) ){
return -1;