From 9fb85a263a72f9f20ebc63c97742f48b81bc2579 Mon Sep 17 00:00:00 2001
From: Dan Stillman <dstillman@zotero.org>
Date: Wed, 3 Feb 2016 01:13:30 -0500
Subject: [PATCH] Fix LIKE errors in Fx44

In Fx44, SQL queries must use '?' with LIKE and cannot concatenate a
placeholder string (e.g., 'foo%'). This is for Sqlite.jsm only, so it
doesn't affect 4.0.
---
 .../zotero/preferences/preferences_advanced.js   | 16 ++++++++++------
 chrome/content/zotero/xpcom/db.js                |  9 +++------
 .../content/zotero/xpcom/storage/storageLocal.js |  3 ++-
 test/tests/zoteroPaneTest.js                     | 10 ++++++++++
 4 files changed, 25 insertions(+), 13 deletions(-)

diff --git a/chrome/content/zotero/preferences/preferences_advanced.js b/chrome/content/zotero/preferences/preferences_advanced.js
index de4ea80f6..04ad854c8 100644
--- a/chrome/content/zotero/preferences/preferences_advanced.js
+++ b/chrome/content/zotero/preferences/preferences_advanced.js
@@ -341,9 +341,11 @@ Zotero_Preferences.Attachment_Base_Directory = {
 	
 	changePath: Zotero.Promise.coroutine(function* (basePath) {
 		// Find all current attachments with relative attachment paths
-		var sql = "SELECT itemID FROM itemAttachments WHERE linkMode=? AND path LIKE '"
-			+ Zotero.Attachments.BASE_PATH_PLACEHOLDER  + "%'";
-		var params = [Zotero.Attachments.LINK_MODE_LINKED_FILE];
+		var sql = "SELECT itemID FROM itemAttachments WHERE linkMode=? AND path LIKE ?";
+		var params = [
+			Zotero.Attachments.LINK_MODE_LINKED_FILE,
+			Zotero.Attachments.BASE_PATH_PLACEHOLDER + "%"
+		];
 		var oldRelativeAttachmentIDs = yield Zotero.DB.columnQueryAsync(sql, params);
 		
 		//Find all attachments on the new base path
@@ -483,9 +485,11 @@ Zotero_Preferences.Attachment_Base_Directory = {
 	
 	clearPath: Zotero.Promise.coroutine(function* () {
 		// Find all current attachments with relative paths
-		var sql = "SELECT itemID FROM itemAttachments WHERE linkMode=? AND path LIKE '"
-			+ Zotero.Attachments.BASE_PATH_PLACEHOLDER  + "%'";
-		var params = [Zotero.Attachments.LINK_MODE_LINKED_FILE];
+		var sql = "SELECT itemID FROM itemAttachments WHERE linkMode=? AND path LIKE ?";
+		var params = [
+			Zotero.Attachments.LINK_MODE_LINKED_FILE,
+			Zotero.Attachments.BASE_PATH_PLACEHOLDER + "%"
+		];
 		var relativeAttachmentIDs = yield Zotero.DB.columnQueryAsync(sql, params);
 		
 		// Prompt for confirmation
diff --git a/chrome/content/zotero/xpcom/db.js b/chrome/content/zotero/xpcom/db.js
index 44a2218e5..5b0ab097c 100644
--- a/chrome/content/zotero/xpcom/db.js
+++ b/chrome/content/zotero/xpcom/db.js
@@ -369,12 +369,9 @@ Zotero.DBConnection.prototype.getNextName = Zotero.Promise.coroutine(function* (
 		[libraryID, table, field, name] = [null, libraryID, table, field];
 	}
 	
-	var sql = "SELECT SUBSTR(" + field + ", " + (name.length + 1) + ") "
-				+ "FROM " + table + " "
-				+ "WHERE libraryID=? AND "
-				+ field + " LIKE '" + name + "%' "
-				+ " ORDER BY " + field;
-	var params = [libraryID];
+	var sql = "SELECT SUBSTR(" + field + ", " + (name.length + 1) + ") FROM " + table
+		+ " WHERE libraryID=? AND " + field + " LIKE ? ORDER BY " + field;
+	var params = [libraryID, name + "%"];
 	var suffixes = yield this.columnQueryAsync(sql, params);
 	suffixes.filter(function (x) x.match(/^( [0-9]+)?$/));
 	
diff --git a/chrome/content/zotero/xpcom/storage/storageLocal.js b/chrome/content/zotero/xpcom/storage/storageLocal.js
index d261b22e9..e800bb01d 100644
--- a/chrome/content/zotero/xpcom/storage/storageLocal.js
+++ b/chrome/content/zotero/xpcom/storage/storageLocal.js
@@ -438,7 +438,8 @@ Zotero.Sync.Storage.Local = {
 		sql += ") "
 			// Skip attachments with empty path, which can't be saved, and files with .zotero*
 			// paths, which have somehow ended up in some users' libraries
-			+ "AND path!='' AND path NOT LIKE 'storage:.zotero%'";
+			+ "AND path!='' AND path NOT LIKE ?";
+		params.push('storage:.zotero%');
 		return Zotero.DB.columnQueryAsync(sql, params);
 	},
 	
diff --git a/test/tests/zoteroPaneTest.js b/test/tests/zoteroPaneTest.js
index da8dd3515..03a59b8e1 100644
--- a/test/tests/zoteroPaneTest.js
+++ b/test/tests/zoteroPaneTest.js
@@ -56,6 +56,16 @@ describe("ZoteroPane", function() {
 		})
 	})
 	
+	describe("#newCollection()", function () {
+		it("should create a collection", function* () {
+			var promise = waitForDialog();
+			var id = yield zp.newCollection();
+			yield promise;
+			var collection = Zotero.Collections.get(id);
+			assert.isTrue(collection.name.startsWith(Zotero.getString('pane.collections.untitled')));
+		});
+	});
+	
 	describe("#itemSelected()", function () {
 		it.skip("should update the item count", function* () {
 			var collection = new Zotero.Collection;