using System; using System.Collections.Generic; using System.Linq; using System.Text; using System.Threading.Tasks; namespace FrameworkDAL.Query.DBLevelSetting { public static class ConnectionQB { // Parameterized (@ConnectionName) — previously built via raw string .Replace() on // user-controlled input from the login form and executed via a raw SqlCommand, a // live SQL-injection surface. Fixed alongside the SERVICESERVERID registration bug // this query's IISSERVERID column exists to surface. public const string LOAD_VERSION_IDENFIFER_SERVER_BASED_ON_CONNECTION_SQL = @"SELECT A.SERVERRUNSTATUS AS DBSERVERRUNSTATUS, ISNULL(C.SERVERID, -1) AS IISSERVERID, ISNULL(C.SERVERRUNSTATUS, 1) AS IISSERVERRUNSTATUS, ISNULL(C.PRIMARYBASEURL, '') PRIMAYBASEURL, ISNULL(C.SECONDORYBASEURL, '') AS SECONDORYBASEURL FROM MSERVER A, MSERVERCONFIG B LEFT OUTER JOIN MSERVER C ON(B.SERVICESERVERID = C.SERVERID) WHERE 1 = 1 AND A.SERVERID = B.SERVERID AND B.CONNECTIONNAME = @ConnectionName"; // Resolves PartnerProductId purely from ConnectionName (no ClientId/session available yet — // used by pre-auth endpoints like VersionCheck/GetVersionUrlIdentifier). Same override-wins // logic as PartnerBrandQB.GET_ROUTING_BY_CONNECTION_NAME / UserLoginQB. // GET_PARTNERPRODUCTID_BY_CLIENT_ID: MSERVERCONFIG.PARTNERPRODUCTID (set on this // CONNECTIONNAME's row) wins when set, else falls back to MCLIENTDETAILS.PARTNERPRODUCTID // (by the ClientId that connection routes to). Both columns use -1 as "not set". public const string GET_PARTNERPRODUCTID_BY_CONNECTION_NAME = @" SELECT DISTINCT CASE WHEN SC.PARTNERPRODUCTID <> -1 THEN SC.PARTNERPRODUCTID ELSE CD.PARTNERPRODUCTID END AS PartnerProductId FROM MSERVERCONFIG SC LEFT JOIN MCLIENTDETAILS CD ON CD.CLIENTID = SC.CLIENTID WHERE SC.CONNECTIONNAME = @ConnectionName"; } }