code

service/report.class.php

@@ -114,10 +114,11 @@ class report {
                             continue;
                         $escaped_ids[] =  "'" .common::check_input($id) . "'";
                     }
-                    if(!empty($escaped_ids)){
-                        $array_str = 'ARRAY[' . implode(',', $escaped_ids) . ']';
-                        $sqlWhere_party_id = " OR party_ids && $array_str ";
+                    if(empty($escaped_ids)){
+                        $escaped_ids[] =  "'" .common::check_input('default_value_that_does_not_exist') . "'";
                     }
+                    $array_str = 'ARRAY[' . implode(',', $escaped_ids) . ']';
+                    $sqlWhere_party_id = " OR party_ids && $array_str ";
                 }
                 //Group Name 判断
                 $company = _getCompanyHandNew($_SESSION["ONLINE_USER"],'public');
@@ -132,12 +133,15 @@ class report {
                             continue;
                         $escaped_company[] = "'" . common::check_input($value) . "'";
                     }
-                    if(!empty($escaped_company)){
-                        $array_str = 'ARRAY[' . implode(',', $escaped_company) . ']';
-                        $sqlWhere_group_name = "  OR group_names && $array_str";
+                    if(empty($escaped_company)){
+                        $escaped_company[] = "'" . common::check_input('default_value_that_does_not_exist') . "'";
                     }
+                    $array_str = 'ARRAY[' . implode(',', $escaped_company) . ']';
+                    $sqlWhere_group_name = "  OR group_names && $array_str";
                 }
                 $sqlWhere .= " and ( access_type = 'All Users' ".$sqlWhere_party_id . " ".$sqlWhere_group_name ." ".$systemAccountsqlWhere .")";
+            } else {
+                $sqlWhere .= " and ( 1<>1 ".$systemAccountsqlWhere .")";
             }
 
             $rc = $_POST ['rc'];
@@ -407,10 +411,11 @@ class report {
                             continue;
                         $escaped_ids[] =  "'" .common::check_input($id) . "'";
                     }
-                    if(!empty($escaped_ids)){
-                        $array_str = 'ARRAY[' . implode(',', $escaped_ids) . ']';
-                        $sqlWhere_party_id = " OR party_ids && $array_str ";
+                    if(empty($escaped_ids)){
+                        $escaped_ids[] =  "'" .common::check_input('default_value_that_does_not_exist') . "'";
                     }
+                    $array_str = 'ARRAY[' . implode(',', $escaped_ids) . ']';
+                    $sqlWhere_party_id = " OR party_ids && $array_str ";
                 }
                 //Group Name 判断
                 $company = _getCompanyHandNew($_SESSION["ONLINE_USER"],'public');
@@ -425,12 +430,15 @@ class report {
                             continue;
                         $escaped_company[] = "'" . common::check_input($value) . "'";
                     }
-                    if(!empty($escaped_company)){
-                        $array_str = 'ARRAY[' . implode(',', $escaped_company) . ']';
-                        $sqlWhere_group_name = "  OR group_names && $array_str";
+                    if(empty($escaped_company)){
+                        $escaped_company[] = "'" . common::check_input('default_value_that_does_not_exist') . "'";
                     }
+                    $array_str = 'ARRAY[' . implode(',', $escaped_company) . ']';
+                    $sqlWhere_group_name = "  OR group_names && $array_str";
                 }
                 $sqlWhere .= " and ( access_type = 'All Users' ".$sqlWhere_party_id . " ".$sqlWhere_group_name ." ".$systemAccountsqlWhere .")";
+            } else {
+                $sqlWhere .= " and ( 1<>1 ".$systemAccountsqlWhere .")";
             }