Bug in Workflow ListView model...

See this section of code:

https://code.vtiger.com/vtiger/vtigercrm/blob/7.4.0/modules/Settings/Workflows/models/ListView.php#L147

It's just wrong.

if($sourceModule) {
    $listQuery .= " WHERE module_name = '$sourceModule'";
    array_push($params, $sourceModule);
}

It is trying to add the encapsulated $sourceModule (but without escaping the "'") name string to the query AND adding it to the params for the pquery call later on.

Either the $listQuery addition should be:

    $listQuery .= " WHERE module_name = ?";

Preferred.

Or $sourceModule should NOT be added to the params for the pquery call and it should look like this:

    $listQuery .= " WHERE module_name = '".$sourceModule."'";

It can't possibly work when doing both!!!

mentioned in commit 70483b78

This is still an issue.

This particular bug, which #1746 (closed) is a dupe of, appears to have been fixed with commit 27ff6e7.

However I realised there is actually another potential bug here. If $sourceModule is empty but the $search_value is not empty, then the generated query will be wrong as there will be no WHERE clause...

The SQL would then like like this:

SELECT count(*) AS count FROM com_vtiger_workflows INNER JOIN vtiger_tab ON vtiger_tab.name = com_vtiger_workflows.module_name AND vtiger_tab.presence IN (0,2) AND workflowname like ?

mentioned in commit 27ff6e7d