From 712bd4169c69b8645031a93c6f1a3a59cf3520f1 Mon Sep 17 00:00:00 2001
From: ghispi <ghispi@gmail.com>
Date: Wed, 7 May 2014 15:53:13 +0200
Subject: [PATCH 1/5] update all updated only one document

---
 core/MY_Model.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/core/MY_Model.php b/core/MY_Model.php
index 369d4ab..b014092 100644
--- a/core/MY_Model.php
+++ b/core/MY_Model.php
@@ -455,7 +455,7 @@ public function update_all($data)
         {
             $result = $this->{$this->_interface}
                 ->set($data)
-                ->update($this->_datasource);
+                ->update_all($this->_datasource);
         }
 
         // Run registered callbacks

From e3f238dab6bce3379b4a1e6e17729e6f356a95d3 Mon Sep 17 00:00:00 2001
From: ghispi <ghispi@gmail.com>
Date: Wed, 7 May 2014 16:00:00 +0200
Subject: [PATCH 2/5] count fixes

- _set_where not needed as it is passed to _count
- in _count its better to use library count then fetching all results and counting them
---
 core/MY_Model.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/core/MY_Model.php b/core/MY_Model.php
index b014092..a74ae94 100644
--- a/core/MY_Model.php
+++ b/core/MY_Model.php
@@ -575,7 +575,7 @@ function dropdown()
     public function count_by()
     {
         $where = func_get_args();
-        $this->_set_where($where);
+//        $this->_set_where($where);
 
         return $this->_count($where);
     }
@@ -855,7 +855,7 @@ private function _count($all = TRUE)
         }
 
         $count = $this->_mongodb
-            ? count($this->mongo_db->get($this->_datasource))
+            ? $this->mongo_db->count($this->_datasource)
             : $this->db->$method($this->_datasource);
 
         // Restore MongoDB buffered conditions

From f089d76380788f3a4d8a8ee038ee97184f547bb7 Mon Sep 17 00:00:00 2001
From: ghispi <ghispi@gmail.com>
Date: Wed, 7 May 2014 16:04:09 +0200
Subject: [PATCH 3/5] many before / after callback fix

initially each callback got data from operation and forgot any changes from previous callback function, now changed data is passed to the next callback
---
 core/MY_Model.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/core/MY_Model.php b/core/MY_Model.php
index a74ae94..c7d0188 100644
--- a/core/MY_Model.php
+++ b/core/MY_Model.php
@@ -734,7 +734,7 @@ private function _run_before_callbacks($type, $params = array())
         {
             foreach ($this->$name as $method)
             {
-                $data = call_user_func_array(array($this, $method), $params);
+                $data = call_user_func_array(array($this, $method), array($data));
             }
         }
 
@@ -756,7 +756,7 @@ private function _run_after_callbacks($type, $params = array())
         {
             foreach ($this->$name as $method)
             {
-                $data = call_user_func_array(array($this, $method), $params);
+                $data = call_user_func_array(array($this, $method), array($data));
             }
         }
 

From 7203b242983b0c08a4a72827d8a73d19dcbf6c71 Mon Sep 17 00:00:00 2001
From: ghispi <ghispi@gmail.com>
Date: Wed, 7 May 2014 16:06:22 +0200
Subject: [PATCH 4/5] _prep_fields update / extension

 - fix to allow updating subdocument fields
 - fix to allow null values for keys, null-byte injection is about null character in key, not in value
---
 core/MY_Model.php | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/core/MY_Model.php b/core/MY_Model.php
index c7d0188..317d652 100644
--- a/core/MY_Model.php
+++ b/core/MY_Model.php
@@ -989,11 +989,15 @@ public function _prep_fields(&$fields, $update = FALSE)
         foreach ($fields as $key => $value)
         {
             // Null-byte injection?
-            if (!isset($this->_fields[$key]))
-            {
-                unset($fields[$key]);
+            $keys = explode('.', $key);
+            $tmp = $this->_fields;
+            foreach ($keys as $key) {
+                if (!array_key_exists($key, $tmp)) {
+                    unset($fields[reset($keys)]);
+                    break;
+                }
+                $tmp = $tmp[$key];
             }
-
             // SQL-like injection?
             // else
             // {

From 858534698f7fb36bca1fd69fb020a742761eab35 Mon Sep 17 00:00:00 2001
From: ghispi <ghispi@users.noreply.github.com>
Date: Tue, 3 Jun 2014 13:35:54 +0200
Subject: [PATCH 5/5] update_many fix

it was updating only one document
---
 core/MY_Model.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/core/MY_Model.php b/core/MY_Model.php
index 317d652..fcdf5bd 100644
--- a/core/MY_Model.php
+++ b/core/MY_Model.php
@@ -387,7 +387,7 @@ public function update_many($primary_values, $data, $skip_validation = FALSE)
                 $result = $this->{$this->_interface}
                     ->where_in($this->primary_key, $this->_prep_primary($primary_values))
                     ->set($data)
-                    ->update($this->_datasource);
+                    ->update_all($this->_datasource);
             }
 
             // Run registered callbacks