Fix LIKE errors in Fx44

In Fx44, SQL queries must use '?' with LIKE and cannot concatenate a
placeholder string (e.g., 'foo%'). This is for Sqlite.jsm only, so it
doesn't affect 4.0.

chrome/content/zotero/preferences/preferences_advanced.js

@@ -341,9 +341,11 @@ Zotero_Preferences.Attachment_Base_Directory = {
 	
 	changePath: Zotero.Promise.coroutine(function* (basePath) {
 		// Find all current attachments with relative attachment paths
-		var sql = "SELECT itemID FROM itemAttachments WHERE linkMode=? AND path LIKE '"
+		var sql = "SELECT itemID FROM itemAttachments WHERE linkMode=? AND path LIKE ?";
-			+ Zotero.Attachments.BASE_PATH_PLACEHOLDER  + "%'";
+		var params = [
-		var params = [Zotero.Attachments.LINK_MODE_LINKED_FILE];
+			Zotero.Attachments.LINK_MODE_LINKED_FILE,
+			Zotero.Attachments.BASE_PATH_PLACEHOLDER + "%"
+		];
 		var oldRelativeAttachmentIDs = yield Zotero.DB.columnQueryAsync(sql, params);
 		
 		//Find all attachments on the new base path
@@ -483,9 +485,11 @@ Zotero_Preferences.Attachment_Base_Directory = {
 	
 	clearPath: Zotero.Promise.coroutine(function* () {
 		// Find all current attachments with relative paths
-		var sql = "SELECT itemID FROM itemAttachments WHERE linkMode=? AND path LIKE '"
+		var sql = "SELECT itemID FROM itemAttachments WHERE linkMode=? AND path LIKE ?";
-			+ Zotero.Attachments.BASE_PATH_PLACEHOLDER  + "%'";
+		var params = [
-		var params = [Zotero.Attachments.LINK_MODE_LINKED_FILE];
+			Zotero.Attachments.LINK_MODE_LINKED_FILE,
+			Zotero.Attachments.BASE_PATH_PLACEHOLDER + "%"
+		];
 		var relativeAttachmentIDs = yield Zotero.DB.columnQueryAsync(sql, params);
 		
 		// Prompt for confirmation

chrome/content/zotero/xpcom/db.js

@@ -369,12 +369,9 @@ Zotero.DBConnection.prototype.getNextName = Zotero.Promise.coroutine(function* (
 		[libraryID, table, field, name] = [null, libraryID, table, field];
 	}
 	
-	var sql = "SELECT SUBSTR(" + field + ", " + (name.length + 1) + ") "
+	var sql = "SELECT SUBSTR(" + field + ", " + (name.length + 1) + ") FROM " + table
-				+ "FROM " + table + " "
+		+ " WHERE libraryID=? AND " + field + " LIKE ? ORDER BY " + field;
-				+ "WHERE libraryID=? AND "
+	var params = [libraryID, name + "%"];
-				+ field + " LIKE '" + name + "%' "
-				+ " ORDER BY " + field;
-	var params = [libraryID];
 	var suffixes = yield this.columnQueryAsync(sql, params);
 	suffixes.filter(function (x) x.match(/^( [0-9]+)?$/));
 	

chrome/content/zotero/xpcom/storage/storageLocal.js

@@ -438,7 +438,8 @@ Zotero.Sync.Storage.Local = {
 		sql += ") "
 			// Skip attachments with empty path, which can't be saved, and files with .zotero*
 			// paths, which have somehow ended up in some users' libraries
-			+ "AND path!='' AND path NOT LIKE 'storage:.zotero%'";
+			+ "AND path!='' AND path NOT LIKE ?";
+		params.push('storage:.zotero%');
 		return Zotero.DB.columnQueryAsync(sql, params);
 	},
 	

test/tests/zoteroPaneTest.js

@@ -56,6 +56,16 @@ describe("ZoteroPane", function() {
 		})
 	})
 	
+	describe("#newCollection()", function () {
+		it("should create a collection", function* () {
+			var promise = waitForDialog();
+			var id = yield zp.newCollection();
+			yield promise;
+			var collection = Zotero.Collections.get(id);
+			assert.isTrue(collection.name.startsWith(Zotero.getString('pane.collections.untitled')));
+		});
+	});
+	
 	describe("#itemSelected()", function () {
 		it.skip("should update the item count", function* () {
 			var collection = new Zotero.Collection;