From bdcff5b0e5f72207ca6572d89436b477873117c0 Mon Sep 17 00:00:00 2001
From: Justin Carter <justin@daemon.com.au>
Date: Fri, 12 Feb 2016 10:04:06 +1100
Subject: [PATCH] FC-3063 check objectid is a valid UUID in findType()

---
 packages/coapi/coapiUtilities.cfc | 40 ++++++++++++++++---------------
 1 file changed, 21 insertions(+), 19 deletions(-)

diff --git a/packages/coapi/coapiUtilities.cfc b/packages/coapi/coapiUtilities.cfc
index b7849e4bb..e0983264d 100644
--- a/packages/coapi/coapiUtilities.cfc
+++ b/packages/coapi/coapiUtilities.cfc
@@ -151,27 +151,29 @@
 		<cfif structKeyExists(variables.stRefobjects, arguments.objectid)>
 			<cfset result = variables.stRefobjects[arguments.objectid] />
 		<cfelse>
-			
-			<cfquery datasource="#arguments.dsn#" name="qFindType">
-			select typename from #arguments.dbowner#refObjects
-			where objectID = <cfqueryparam cfsqltype="cf_sql_varchar" value="#arguments.objectID#" />
-			</cfquery>
-			
-			<cfif qFindType.recordCount>
-				<cfset result = qFindType.typename />
-			<cfelse>		
-				<cfif isDefined("Session") AND structKeyExists(Session, "TempObjectStore") 
-					AND structKeyExists(Session.TempObjectStore, "#arguments.objectid#")
-					AND structKeyExists(Session.TempObjectStore["#arguments.objectid#"], "typename")>
-					
-					<cfset result = Session.TempObjectStore["#arguments.objectid#"].typename />
+
+			<cfif isValid("uuid", arguments.objectID)>
+				<cfquery datasource="#arguments.dsn#" name="qFindType">
+				select typename from #arguments.dbowner#refObjects
+				where objectID = <cfqueryparam cfsqltype="cf_sql_varchar" value="#arguments.objectID#" />
+				</cfquery>
+				
+				<cfif qFindType.recordCount>
+					<cfset result = qFindType.typename />
+				<cfelse>		
+					<cfif isDefined("Session") AND structKeyExists(Session, "TempObjectStore") 
+						AND structKeyExists(Session.TempObjectStore, "#arguments.objectid#")
+						AND structKeyExists(Session.TempObjectStore["#arguments.objectid#"], "typename")>
+						
+						<cfset result = Session.TempObjectStore["#arguments.objectid#"].typename />
+					</cfif>
+				</cfif>	
+				
+				<cfif len(result)>
+					<cfset variables.stRefobjects[arguments.objectid] = result />
 				</cfif>
-			</cfif>	
-			
-			<cfif len(result)>
-				<cfset variables.stRefobjects[arguments.objectid] = result />
 			</cfif>
-			
+
 		</cfif>
 		
 		<cfreturn result />