Improved sfety of inner join for timesheet assignment.

[timetracker.git] / WEB-INF / lib / ttReportHelper.class.php

diff --git a/WEB-INF/lib/ttReportHelper.class.php b/WEB-INF/lib/ttReportHelper.class.php
index a64bb8700e31749b127cace55e6dd6c239942fc6..0fa00d1303ee13c582232b2267a3fb20d328541d 100644 (file)
--- a/WEB-INF/lib/ttReportHelper.class.php
+++ b/WEB-INF/lib/ttReportHelper.class.php
@@ -640,7 +640,8 @@ class ttReportHelper {
 
     if ($time_log_ids) {
       if ($timesheet_id)
-        $inner_join = " inner join tt_timesheets ts on (ts.id = $timesheet_id and ts.approve_status is null)";
+        $inner_join = " inner join tt_timesheets ts on (ts.id = $timesheet_id".
+          " and ts.user_id = $user_id and ts.approve_status is null)";
 
       $sql = "update tt_log l $inner_join".
         " set l.timesheet_id = ".$mdb2->quote($timesheet_id).