Merge pull request sakaiproject#280 from ottenhoff/SAM-2492

SAM-2492 need to refer to MySQL table name in correct case and fix parametized JDBC insert
susowrc · Mar 12, 2015 · 2466d74 · 2466d74
2 parents 614abb7 + 75d0504
commit 2466d74
Showing 1 changed file with 11 additions and 7 deletions.
diff --git a/...-services/src/java/org/sakaiproject/tool/assessment/facade/QuestionPoolFacadeQueries.java b/...-services/src/java/org/sakaiproject/tool/assessment/facade/QuestionPoolFacadeQueries.java
@@ -1597,13 +1597,16 @@ public void transferPoolsOwnership(String ownerId, final List<Long> transferPool
                   boolean autoCommit = conn.getAutoCommit();
   		  String query = "";
   		  if (!"".equals(updateOwnerIdInPoolTableQueryString)) {
-  			  query = "UPDATE sam_questionpoolaccess_t SET agentid = '" + ownerId +"' WHERE questionpoolid IN (" + updateOwnerIdInPoolTableQueryString + ")" + 
-  					  " AND accesstypeid = 34";					 
+  			  query = "UPDATE SAM_QUESTIONPOOLACCESS_T SET agentid = ? WHERE questionpoolid IN (?) AND accesstypeid = 34";
   			  statement = conn.prepareStatement(query);
+  			  statement.setString(1, ownerId);
+  			  statement.setString(2, updateOwnerIdInPoolTableQueryString);
   			  statement.executeUpdate();
 
-  			  query = "UPDATE sam_questionpool_t SET ownerid = '" + ownerId + "' WHERE questionpoolid IN (" + updateOwnerIdInPoolTableQueryString + ")";
+  			  query = "UPDATE SAM_QUESTIONPOOL_T SET ownerid = ? WHERE questionpoolid IN (?)";
 			  statement = conn.prepareStatement(query);
+  			  statement.setString(1, ownerId);
+  			  statement.setString(2, updateOwnerIdInPoolTableQueryString);
 			  statement.executeUpdate();
 
                           if (!autoCommit) {
@@ -1613,8 +1616,9 @@ public void transferPoolsOwnership(String ownerId, final List<Long> transferPool
 
   		  // if the pool has parent but the parent doesn't transfer, need to remove the child-parent relationship.
   		  if (!"".equals(removeParentPoolString)) {
-  			  query = "UPDATE sam_questionpool_t SET parentpoolid = " + 0 + " WHERE questionpoolid IN (" + removeParentPoolString + ")";
+  			  query = "UPDATE SAM_QUESTIONPOOL_T SET parentpoolid = 0 WHERE questionpoolid IN (?)";
   			  statement = conn.prepareStatement(query);
+  			  statement.setString(1, removeParentPoolString);
   			  statement.executeUpdate();	
 
                           if (!autoCommit) {
@@ -1628,23 +1632,23 @@ public void transferPoolsOwnership(String ownerId, final List<Long> transferPool
 			  try {
 				  statement.close();
 			  } catch (Exception ex) {
-				  ex.printStackTrace();
+				  log.warn("Could not close statement", ex);
 			  }
 		  }
 
   		  if (conn != null) {
 			  try {
 				  conn.close();
 			  } catch (Exception ex) {
-				  ex.printStackTrace();
+				  log.warn("Could not close conn", ex);
 			  }
 		  }
 
   		  if (session != null) {
   			  try {
   				  session.close();
 			  } catch (Exception ex) {
-				  ex.printStackTrace();
+				  log.warn("Could not close session", ex);
 			  }
   		  }
   	  }