CVE-2015-2972: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: Multiple SQL injection vulnerabilities in Sysphonic Thetis before 2.3.0 allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Published: 2015-07-19T15:59Z
Repository: https://github.com/sysphonic/thetis
Language: Ruby
Files changed: app/controllers/desktop_controller.rb, app/controllers/items_controller.rb, app/controllers/login_controller.rb, app/controllers/mail_folders_controller.rb, app/controllers/timecards_controller.rb, app/controllers/zeptair_post_controller.rb, app/helpers/items_helper.rb, app/helpers/sql_helper.rb, app/helpers/templates_helper.rb, app/helpers/tree_element.rb, app/helpers/zeptair_dist_helper.rb, app/models/address.rb, app/models/email.rb, app/models/folder.rb, app/models/group.rb, app/models/location.rb, app/models/mail_account.rb, app/models/mail_folder.rb, app/models/paid_holiday.rb, app/models/research.rb, app/models/setting.rb, app/models/team.rb, app/models/timecard.rb, app/models/toy.rb, app/models/user.rb, app/views/common/_edit_scope.html.erb, app/views/schedules/_edit_members.html.erb, app/views/send_mails/edit_send_to.html.erb, app/views/timecards/group.html.erb
Commit date: 2015-07-07 09:10:26 +0900
Commit message: Reinforcement of security.
Signed-off-by: MORITA Shintaro <shin@sysphonic.com>

Diff: diff --git a/app/controllers/desktop_controller.rb b/app/controllers/desktop_controller.rb
index bc82891..4987aa1 100644
--- a/app/controllers/desktop_controller.rb
+++ b/app/controllers/desktop_controller.rb
@@ -89,11 +89,11 @@ class DesktopController < ApplicationController
   def edit_timecard
     Log.add_info(request, params.inspect)
 
     date_s = params[:date]
 
-    if date_s.nil? or date_s.empty?
+    if date_s.blank?
       @date = Date.today
       date_s = @date.strftime(Schedule::SYS_DATE_FORM)
     else
       @date = Date.parse(date_s)
     end
diff --git a/app/controllers/items_controller.rb b/app/controllers/items_controller.rb
index ddfd150..aa27348 100644
--- a/app/controllers/items_controller.rb
+++ b/app/controllers/items_controller.rb
@@ -1270,13 +1270,14 @@ class ItemsController < ApplicationController
           return
         end
       end
 
       users = @team.get_users_a
-    end 
+    end
 
     team_members = params[:team_members]
+    SqlHelper.validate_token([team_members])
 
     created = false
     modified = false
 
     if team_members.nil? or team_members.empty?
@@ -1303,13 +1304,13 @@ class ItemsController < ApplicationController
         else
 
           @team.clear_users
         end
 
-        @team.add_users team_members
+        @team.add_users(team_members)
         @team.save
-        @team.remove_application team_members
+        @team.remove_application(team_members)
 
         modified = true 
       end
      end
 
diff --git a/app/controllers/login_controller.rb b/app/controllers/login_controller.rb
index 65c73ac..8232e33 100644
--- a/app/controllers/login_controller.rb
+++ b/app/controllers/login_controller.rb
@@ -95,11 +95,11 @@ class LoginController < ApplicationController
   #
   def send_password
     Log.add_info(request, params.inspect)
 
     mail_addr = params[:thetisBoxEdit]
-    SqlHelper.validate_token([mail_addr], ['@-'])
+    SqlHelper.validate_token([mail_addr])
     begin
       users = User.where("email='#{mail_addr}'").to_a
     rescue => evar
     end
 
diff --git a/app/controllers/mail_folders_controller.rb b/app/controllers/mail_folders_controller.rb
index 5859ddd..0b355d2 100644
--- a/app/controllers/mail_folders_controller.rb
+++ b/app/controllers/mail_folders_controller.rb
@@ -30,13 +30,13 @@ class MailFoldersController < ApplicationController
 
     con = []
     con << "(user_id=#{@login_user.id})"
 
     account_xtype = params[:mail_account_xtype]
+    SqlHelper.validate_token([account_xtype])
 
     unless account_xtype.blank?
-      SqlHelper.validate_token([account_xtype])
       con << "(xtype='#{account_xtype}')"
     end
     @mail_accounts = MailAccount.find_all(con.join(' and '))
 
     mail_account_ids = []
diff --git a/app/controllers/timecards_controller.rb b/app/controllers/timecards_controller.rb
index 1b9b5ff..de91294 100644
--- a/app/controllers/timecards_controller.rb
+++ b/app/controllers/timecards_controller.rb
@@ -118,11 +118,11 @@ class TimecardsController < ApplicationController
   def edit
     Log.add_info(request, params.inspect)
 
     date_s = params[:date]
 
-    if date_s.nil? or date_s.empty?
+    if date_s.blank?
       @date = Date.today
       date_s = @date.strftime(Schedule::SYS_DATE_FORM)
     else
       @date = Date.parse(date_s)
     end
diff --git a/app/controllers/zeptair_post_controller.rb b/app/controllers/zeptair_post_controller.rb
index bc45e88..f2a12b6 100644
--- a/app/controllers/zeptair_post_controller.rb
+++ b/app/controllers/zeptair_post_controller.rb
@@ -79,37 +79,39 @@ class ZeptairPostController < ApplicationController
       return
     end
 
     target_user = nil
 
-    SqlHelper.validate_token([params[:user_id], params[:zeptair_id], params[:group_id]])
+    user_id = params[:user_id]
+    zeptair_id = params[:zeptair_id]
+    group_id = params[:group_id]
+    SqlHelper.validate_token([user_id, zeptair_id, group_id])
 
-    unless params[:user_id].blank?
-      target_user = User.find(params[:user_id])
+    unless user_id.blank?
+      target_user = User.find(user_id)
     end
 
-    unless params[:zeptair_id].blank?
-      zeptair_id = params[:zeptair_id]
+    unless zeptair_id.blank?
       target_user = User.where("zeptair_id=#{zeptair_id}").first
     end
 
     if target_user.nil?
 
-      if params[:group_id].blank?
+      if group_id.blank?
         sql = 'select distinct Item.* from items Item, attachments Attachment'
         sql << " where Item.xtype='#{Item::XTYPE_ZEPTAIR_POST}' and Item.id=Attachment.item_id"
         sql << ' order by Item.user_id ASC'
       else
-        group_ids = [params[:group_id]]
+        group_ids = [group_id]
 
         if params[:recursive] == 'true'
-          group_ids += Group.get_childs(params[:group_id], true, false)
+          group_ids += Group.get_childs(group_id, true, false)
         end
 
         groups_con = []
-        group_ids.each do |group_id|
-          groups_con << SqlHelper.get_sql_like(['User.groups'], "|#{@group_id}|")
+        group_ids.each do |grp_id|
+          groups_con << SqlHelper.get_sql_like(['User.groups'], "|#{grp_id}|")
         end
         sql = 'select distinct Item.* from items Item, attachments Attachment, users User'
         sql << " where Item.xtype='#{Item::XTYPE_ZEPTAIR_POST}' and Item.id=Attachment.item_id"
         sql << " and (Item.user_id=User.id and (#{groups_con.join(' or ')}))"
         sql << ' order by Item.user_id ASC'
@@ -132,27 +134,32 @@ class ZeptairPostController < ApplicationController
   def delete_attachment
     Log.add_info(request, '')   # Not to show passwords.
 
     target_user = nil
 
-    unless params[:user_id].blank?
-      if @login_user.admin?(User::AUTH_ZEPTAIR) or @login_user.id.to_s == params[:user_id].to_s
-        target_user = User.find(params[:user_id])
+    user_id = params[:user_id]
+    zeptair_id = params[:zeptair_id]
+    attachment_id = params[:attachment_id]
+    SqlHelper.validate_token([user_id, zeptair_id, attachment_id])
+
+    unless user_id.blank?
+      if @login_user.admin?(User::AUTH_ZEPTAIR) or @login_user.id.to_s == user_id.to_s
+        target_user = User.find(user_id)
       end
     end
 
-    unless params[:zeptair_id].blank?
+    unless zeptair_id.blank?
 
-      target_user = User.where("zeptair_id=#{params[:zeptair_id]}").first
+      target_user = User.where("zeptair_id=#{zeptair_id}").first
 
       unless @login_user.admin?(User::AUTH_ZEPTAIR) or @login_user.id == target_user.id
         target_user = nil
       end
     end
 
     if target_user.nil?
-      if params[:attachment_id].blank?
+      if attachment_id.blank?
 
         query
         unless @post_items.nil?
           @post_items.each do |post_item|
             post_item.attachments_without_content.each do |attach|
@@ -161,11 +168,11 @@ class ZeptairPostController < ApplicationController
             post_item.update_attribute(:updated_at, Time.now)
           end
         end
 
       else
-        attach = Attachment.find(params[:attachment_id])
+        attach = Attachment.find(attachment_id)
 
         item = Item.find(attach.item_id)
 
         if !@login_user.admin?(User::AUTH_ZEPTAIR) and item.user_id != @login_user.id
           raise t('msg.need_to_be_owner')
diff --git a/app/helpers/items_helper.rb b/app/helpers/items_helper.rb
index 29b7e9c..64d3318 100644
--- a/app/helpers/items_helper.rb
+++ b/app/helpers/items_helper.rb
@@ -22,10 +22,13 @@ module ItemsHelper
   #_user_id_:: Target User-ID.
   #_source_id_:: Source Item-ID.
   #return:: Next revision number.
   #
   def self.get_next_revision(user_id, source_id)
+
+    SqlHelper.validate_token([user_id, source_id])
+
     copied_items = Item.where("user_id=#{user_id} and source_id=#{source_id}").order('created_at DESC').to_a
 
     rev = 0
     copied_items.each do |item|
       rev_ary = item.title.scan(/[#](\d\d\d)$/)
@@ -33,11 +36,11 @@ module ItemsHelper
 
       rev = rev_ary.first.to_a.first.to_i
       break
     end
 
-    return '#' + sprintf('%03d', rev+1)
+    return ('#' + sprintf('%03d', rev+1))
   end
 
   #=== self.get_copies_folder
   #
   #Gets the Copies Folder in My Folder of the specified User.
diff --git a/app/helpers/sql_helper.rb b/app/helpers/sql_helper.rb
index 7a6c4c6..e6186fb 100644
--- a/app/helpers/sql_helper.rb
+++ b/app/helpers/sql_helper.rb
@@ -23,12 +23,16 @@ module SqlHelper
   #_extra_chars_:: Extra characters.
   #return:: Query condition.
   #
   def self.validate_token(tokens, extra_chars=nil)
 
-    extra_chars = Regexp.escape((extra_chars || []).join())
-    regexp = Regexp.new("^[ ]*[a-zA-Z0-9_.#{extra_chars}]+[ ]*$")
+    if extra_chars.nil?
+      extra_chars = ''
+    else
+      extra_chars = Regexp.escape(extra_chars.join())
+    end
+    regexp = Regexp.new("^[ ]*[a-zA-Z0-9_.@\\-#{extra_chars}]+[ ]*$")
 
     [tokens].flatten.each do |token|
       next if token.blank?
 
       if token.to_s.match(regexp).nil?
diff --git a/app/helpers/templates_helper.rb b/app/helpers/templates_helper.rb
index b1bb49b..f76c736 100644
--- a/app/helpers/templates_helper.rb
+++ b/app/helpers/templates_helper.rb
@@ -164,10 +164,12 @@ module TemplatesHelper
   #_name_:: Sub Folder name.
   #return:: Array of Folders. [$Templates, specified sub Folder].
   #
   def self.get_tmpl_subfolder(name)
 
+    SqlHelper.validate_token([name])
+
     tmpl_folder = Folder.where("folders.name='#{TMPL_ROOT}'").first
 
     unless tmpl_folder.nil?
       con = "(parent_id=#{tmpl_folder.id}) and (name='#{name}')"
       begin
@@ -177,7 +179,6 @@ module TemplatesHelper
       end
     end
 
     return [tmpl_folder, child]
   end
-
 end
diff --git a/app/helpers/tree_element.rb b/app/helpers/tree_element.rb
index fe1c01a..8dce9d4 100644
--- a/app/helpers/tree_element.rb
+++ b/app/helpers/tree_element.rb
@@ -76,10 +76,12 @@ module TreeElement
   #_ret_obj_:: Flag to require node instances by return.
   #return:: Array of child node-IDs, or instances if ret_obj is true.
   #
   def self.get_childs(klass, node_id, recursive, ret_obj)
 
+    SqlHelper.validate_token([node_id])
+
     array = []
 
     if recursive
 
       tree = klass.get_tree(Hash.new, nil, node_id)
@@ -129,10 +131,11 @@ module TreeElement
   #Gets tree of Groups.
   #Called recursive.
   #
   def self.get_tree(klass, tree, conditions, node_id, order_by)
 
+    SqlHelper.validate_token([node_id])
     if conditions.nil?
       con = ''
     else
       con = Marshal.load(Marshal.dump(conditions)) + ' and '
     end
diff --git a/app/helpers/zeptair_dist_helper.rb b/app/helpers/zeptair_dist_helper.rb
index eb978c7..3f44057 100644
--- a/app/helpers/zeptair_dist_helper.rb
+++ b/app/helpers/zeptair_dist_helper.rb
@@ -59,10 +59,11 @@ module ZeptairDistHelper
   #_user_id_:: Target User-ID.
   #return:: Reply as Comment.
   #
   def self.get_comment_of(item_id, user_id)
 
+    SqlHelper.validate_token([item_id, user_id])
     begin
       comment = Comment.where("(user_id=#{user_id}) and (item_id=#{item_id}) and (xtype='#{Comment::XTYPE_DIST_ACK}')").first
     rescue => evar
       Log.add_error(nil, evar)
     end
@@ -141,10 +142,11 @@ module ZeptairDistHelper
   #
   #_item_id_:: Target Item-ID.
   #return:: The number of ACK messages to the specified Distribution Item.
   #
   def self.count_ack_users(item_id)
+    SqlHelper.validate_token([item_id])
     return Comment.where("(item_id=#{item_id}) and (xtype='#{Comment::XTYPE_DIST_ACK}')").count
   end
 
   #=== self.count_completed_users
   #
@@ -152,10 +154,11 @@ module ZeptairDistHelper
   #
   #_item_id_:: Target Item-ID.
   #return:: The number of completed users of the specified Distribution Item.
   #
   def self.count_completed_users(item_id)
+    SqlHelper.validate_token([item_id])
     ack_msg = ZeptairDistHelper.completed_ack_message(item_id)
     return Comment.where("(item_id=#{item_id}) and (xtype='#{Comment::XTYPE_DIST_ACK}') and (message='#{ack_msg}')").count
   end
 
   #=== self.get_feeds
diff --git a/app/models/address.rb b/app/models/address.rb
index 7eefef6..20e9159 100644
--- a/app/models/address.rb
+++ b/app/models/address.rb
@@ -34,10 +34,12 @@ class Address < ActiveRecord::Base
   #_book_:: Book type.
   #return:: Array of Addresses.
   #
   def self.get_by_email(mail_addr, user, book=Address::BOOK_BOTH)
 
+    SqlHelper.validate_token([mail_addr])
+
     email_con = []
     email_con.push("(email1='#{mail_addr}')")
     email_con.push("(email2='#{mail_addr}')")
     email_con.push("(email3='#{mail_addr}')")
     con = []
diff --git a/app/models/email.rb b/app/models/email.rb
index 6c50aad..8d5f026 100644
--- a/app/models/email.rb
+++ b/app/models/email.rb
@@ -616,10 +616,13 @@ EOT
   #_user_id_:: Target User-ID.
   #_mail_account_id_:: Target MailAccount-ID.
   #_max_:: Max number.
   #
   def self.trim(user_id, mail_account_id, max)
+
+    SqlHelper.validate_token([user_id, mail_account_id])
+
     begin
       count = Email.where("mail_account_id=#{mail_account_id}").count
       if count > max
 #logger.fatal("[INFO] Email.trim(user_id:#{user_id}, mail_account_id:#{mail_account_id}, max:#{max})")
         over_num = count - max
@@ -755,10 +758,12 @@ EOT
   #_user_id_:: Target User-ID.
   #_add_con_:: Additional condition to query by.
   #
   def self.destroy_by_user(user_id, add_con=nil)
 
+    SqlHelper.validate_token([user_id])
+
     con = "user_id=#{user_id}"
     con << " and (#{add_con})" unless add_con.nil? or add_con.empty?
     emails = Email.where(con).to_a
 
     emails.each do |email|
diff --git a/app/models/folder.rb b/app/models/folder.rb
index f52e715..8411290 100644
--- a/app/models/folder.rb
+++ b/app/models/folder.rb
@@ -639,10 +639,11 @@ class Folder < ActiveRecord::Base
   #_ret_obj_:: Flag to require Folder instances by return.
   #return:: Array of child Folder-IDs, or Folders if ret_obj is true.
   #
   def self.get_childs(folder_id, conditions, recursive, admin, ret_obj)
 
+    SqlHelper.validate_token([folder_id])
     arr = []
 
     if recursive
 
       folder_tree = Folder.get_tree(Hash.new, conditions, folder_id, admin)
diff --git a/app/models/group.rb b/app/models/group.rb
index d2bacfc..78b0581 100644
--- a/app/models/group.rb
+++ b/app/models/group.rb
@@ -372,10 +372,11 @@ class Group < ActiveRecord::Base
   #_group_id_:: Target Group-ID.
   #return:: Folder object of the Group.
   #
   def self.get_group_folder(group_id)
 
+    SqlHelper.validate_token([group_id])
     begin
       return Folder.where("(owner_id=#{group_id}) and (xtype='#{Folder::XTYPE_GROUP}')").first
     rescue => evar
       Log.add_error(nil, evar)
       return nil
diff --git a/app/models/location.rb b/app/models/location.rb
index 78c99e7..9b34ea6 100644
--- a/app/models/location.rb
+++ b/app/models/location.rb
@@ -42,10 +42,11 @@ class Location < ActiveRecord::Base
   #_group_id_:: Target Group-ID.
   #return:: Locations related to the specified Group.
   #
   def self.get_for_group(group_id)
 
+    SqlHelper.validate_token([group_id])
     if group_id.nil?
       con = 'group_id is null'
     else
       con = "group_id=#{group_id}"
     end
diff --git a/app/models/mail_account.rb b/app/models/mail_account.rb
index e5eb9c3..7158d7d 100644
--- a/app/models/mail_account.rb
+++ b/app/models/mail_account.rb
@@ -152,10 +152,12 @@ class MailAccount < ActiveRecord::Base
   #_user_id_:: Target User-ID.
   #_add_con_:: Additional condition to query with.
   #
   def self.destroy_by_user(user_id, add_con=nil)
 
+    SqlHelper.validate_token([user_id])
+
     con = "user_id=#{user_id}"
     con << " and (#{add_con})" unless add_con.nil? or add_con.empty?
     mail_accounts = MailAccount.where(con).to_a
 
     mail_accounts.each do |mail_account|
@@ -263,14 +265,14 @@ class MailAccount < ActiveRecord::Base
     where = ''
     unless con.nil? or con.empty?
       where = 'where ' + con.join(' and ')
     end
 
-    account_ary = MailAccount.find_by_sql('select * from mail_accounts ' + where + ' order by xorder ASC, title ASC')
+    mail_accounts = MailAccount.find_by_sql('select * from mail_accounts ' + where + ' order by xorder ASC, title ASC')
 
-    if account_ary.nil? or account_ary.empty?
+    if mail_accounts.nil? or mail_accounts.empty?
       return nil
     else
-      return account_ary.first
+      return mail_accounts.first
     end
   end
 end
diff --git a/app/models/mail_folder.rb b/app/models/mail_folder.rb
index d0bee9f..9ee5d26 100644
--- a/app/models/mail_folder.rb
+++ b/app/models/mail_folder.rb
@@ -146,10 +146,12 @@ class MailFolder < ActiveRecord::Base
       user_id = user.id
     else
       user_id = user.to_s
     end
 
+    SqlHelper.validate_token([user_id, mail_account_id, xtype])
+
     con = []
     con << "(user_id=#{user_id})"
     con << "(mail_account_id=#{mail_account_id})"
     con << "(xtype='#{xtype}')"
 
@@ -171,10 +173,12 @@ class MailFolder < ActiveRecord::Base
       user_id = user.id
     else
       user_id = user.to_s
     end
 
+    SqlHelper.validate_token([user_id])
+
     con = []
     con << "(user_id=#{user_id})"
     con << "(xtype='#{MailFolder::XTYPE_ACCOUNT_ROOT}')"
 
     order_by = 'xorder ASC, id ASC'
diff --git a/app/models/paid_holiday.rb b/app/models/paid_holiday.rb
index 79a7f8e..7a2a8ff 100644
--- a/app/models/paid_holiday.rb
+++ b/app/models/paid_holiday.rb
@@ -27,10 +27,13 @@ class PaidHoliday < ActiveRecord::Base
   #_user_id_:: Target User-ID.
   #_fiscal_year_:: Target year. If not specified, returns all years'.
   #return:: PaidHoliday(s) for the specified User.
   #
   def self.get_for(user_id, fiscal_year=nil)
+
+    SqlHelper.validate_token([user_id, fiscal_year])
+
     begin
       con = []
       con << "(user_id=#{user_id})"
       if fiscal_year.nil?
         return PaidHoliday.where(con).order('year ASC').to_a
@@ -52,12 +55,17 @@ class PaidHoliday < ActiveRecord::Base
   #_fiscal_year_:: Target year.
   #_num_:: New days. If specified 0, removes the record.
   #
   def self.update_for(user_id, fiscal_year, num)
 
+    SqlHelper.validate_token([user_id, fiscal_year])
+
     if num <= 0
-      PaidHoliday.destroy_all(['user_id=? and year=?', user_id, fiscal_year])
+      con = []
+      con << "(user_id=#{user_id})"
+      con << "(year=#{fiscal_year})"
+      PaidHoliday.destroy_all(con.join(' and '))
       return
     end
 
     paid_holiday = PaidHoliday.get_for(user_id, fiscal_year)
 
@@ -80,10 +88,12 @@ class PaidHoliday < ActiveRecord::Base
   #_year_:: Target year.
   #return:: Number of carried-over PaidHolidays.
   #
   def self.get_carried_over(user_id, year)
 
+    SqlHelper.validate_token([user_id, year])
+
     yaml = ApplicationHelper.get_config_yaml
     unless yaml[:timecard].nil?
       paidhld_carry_over = yaml[:timecard]['paidhld_carry_over']
     end
 
@@ -132,7 +142,6 @@ class PaidHoliday < ActiveRecord::Base
       return (sum - applied_paid_hlds)
     else
       return 0
     end
   end
-
 end
diff --git a/app/models/research.rb b/app/models/research.rb
index f2a275e..95fb54f 100644
--- a/app/models/research.rb
+++ b/app/models/research.rb
@@ -354,10 +354,12 @@ class Research < ActiveRecord::Base
   #_user_id_:: Target User-ID.
   #return:: Research-record of specified User.
   #
   def self.get_for(user_id)
 
+    SqlHelper.validate_token([user_id])
+
     return Research.where("user_id=#{user_id}").first
   end
 
   #=== self.get_q_codes
   #
diff --git a/app/models/setting.rb b/app/models/setting.rb
index c03f03b..6c99ea8 100644
--- a/app/models/setting.rb
+++ b/app/models/setting.rb
@@ -28,10 +28,12 @@ class Setting < ActiveRecord::Base
   #_category_:: Target category. If not required, specify nil.
   #return:: Hash of Settings. { key => value }
   #
   def self.get_for(user_id, category=nil)
 
+    SqlHelper.validate_token([user_id, category])
+
     con = []
     con << "(user_id=#{user_id})"
     con << "(category='#{category}')" unless category.nil?
 
     settings = Setting.where(con.join(' and ')).to_a
@@ -56,10 +58,12 @@ class Setting < ActiveRecord::Base
   #_key_:: Target key.
   #return:: Setting value.
   #
   def self.get_value(user_id, category, key)
 
+    SqlHelper.validate_token([user_id, category, key])
+
     con = []
     con << "(user_id=#{user_id})"
     con << "(category='#{category}')"
     con << "(xkey='#{key}')"
 
@@ -79,10 +83,12 @@ class Setting < ActiveRecord::Base
   #_key_:: Target key.
   #_value_:: Value to save.
   #
   def self.save_value(user_id, category, key, value)
 
+    SqlHelper.validate_token([user_id, category, key])
+
     con = []
     con << "(user_id=#{user_id})"
     con << "(category='#{category}')"
     con << "(xkey='#{key}')"
 
@@ -116,10 +122,12 @@ class Setting < ActiveRecord::Base
   #_category_:: Target category. If not required, specify nil.
   #return:: Hash of Settings. { key => value }
   #
   def self.get_for_group(group_id, category=nil)
 
+    SqlHelper.validate_token([group_id, category])
+
     con = []
     con << "(group_id=#{group_id})"
     con << "(category='#{category}')" unless category.nil?
 
     settings = Setting.where(con.join(' and ')).to_a
@@ -144,10 +152,12 @@ class Setting < ActiveRecord::Base
   #_key_:: Target key.
   #return:: Setting value.
   #
   def self.get_group_value(group_id, category, key)
 
+    SqlHelper.validate_token([group_id, category, key])
+
     con = []
     con << "(group_id=#{group_id})"
     con << "(category='#{category}')"
     con << "(xkey='#{key}')"
 
@@ -167,10 +177,12 @@ class Setting < ActiveRecord::Base
   #_key_:: Target key.
   #_value_:: Value to save.
   #
   def self.save_group_value(group_id, category, key, value)
 
+    SqlHelper.validate_token([group_id, category, key])
+
     con = []
     con << "(group_id=#{group_id})"
     con << "(category='#{category}')"
     con << "(xkey='#{key}')"
 
diff --git a/app/models/team.rb b/app/models/team.rb
index 1cefeab..56ab9b3 100644
--- a/app/models/team.rb
+++ b/app/models/team.rb
@@ -363,10 +363,11 @@ class Team < ActiveRecord::Base
   #_team_id_:: Target Team-ID.
   #return:: Folder object of the Team.
   #
   def self.get_team_folder(team_id)
 
+    SqlHelper.validate_token([team_id])
     begin
       return Folder.where("(owner_id=#{team_id}) and (xtype='#{Folder::XTYPE_TEAM}')").first
     rescue => evar
       Log.add_error(nil, evar)
       return nil
@@ -395,25 +396,26 @@ class Team < ActiveRecord::Base
 
   #=== remove_application
   #
   #Removes applications of the specified Users.
   #
-  #_users_:: Array of User-IDs.
+  #_user_ids_:: Array of User-IDs.
   #
-  def remove_application(users)
+  def remove_application(user_ids)
 
-    return if users.nil? or users.empty?
+    return if user_ids.nil? or user_ids.empty?
 
-    array = ["(xtype='#{Comment::XTYPE_APPLY}')"]
-    array << "(item_id=#{self.item_id})"
+    SqlHelper.validate_token([user_ids])
+
+    con = ["(xtype='#{Comment::XTYPE_APPLY}')"]
+    con << "(item_id=#{self.item_id})"
 
     user_con_a = []
-    users.each do |user_id|
+    user_ids.each do |user_id|
       user_con_a << "(user_id=#{user_id})"
     end
 
-    array << '(' + user_con_a.join(' or ') + ')'
+    con << '(' + user_con_a.join(' or ') + ')'
 
-    Comment.destroy_all(array.join(' and '))
+    Comment.destroy_all(con.join(' and '))
  end
-
 end
diff --git a/app/models/timecard.rb b/app/models/timecard.rb
index 6dc3ddf..5c439be 100644
--- a/app/models/timecard.rb
+++ b/app/models/timecard.rb
@@ -420,16 +420,18 @@ class Timecard < ActiveRecord::Base
   #=== self.get_for
   #
   #Gets Timecard of the specified User and Date.
   #
   #_user_id_:: Target User-ID.
-  #_date_:: Target Date.
+  #_date_s_:: Target Date string.
   #return:: Timecard for the specified User and Date.
   #
-  def self.get_for(user_id, date)
+  def self.get_for(user_id, date_s)
+
+    SqlHelper.validate_token([user_id, date_s])
     begin
-      con = "(user_id=#{user_id}) and (date='#{date}')"
+      con = "(user_id=#{user_id}) and (date='#{date_s}')"
       return Timecard.where(con).first
     rescue
     end
     return nil
   end
@@ -442,11 +444,17 @@ class Timecard < ActiveRecord::Base
   #_start_date_:: Start Date of the span.
   #_end_date_:: End Date of the span.
   #return:: Timecard for the specified User and span.
   #
   def self.find_term(user_id, start_date, end_date)
-    con = "(user_id=#{user_id}) and (date >= '#{start_date}') and (date <= '#{end_date}')"
+
+    SqlHelper.validate_token([user_id])
+
+    start_s = start_date.strftime(Schedule::SYS_DATE_FORM)
+    end_s = end_date.strftime(Schedule::SYS_DATE_FORM)
+
+    con = "(user_id=#{user_id}) and (date >= '#{start_s}') and (date <= '#{end_s}')"
     ary = Timecard.where(con).order('date ASC').to_a
     timecards_h = Hash.new
     unless ary.nil?
       ary.each do |timecard|
         timecards_h[timecard.date.strftime(Schedule::SYS_DATE_FORM)] = timecard
@@ -464,13 +472,16 @@ class Timecard < ActiveRecord::Base
   #_end_date_:: End Date of the span.
   #return:: Number of applied paid holidays.
   #
   def self.applied_paid_hlds(user_id, start_date, end_date)
 
-    SqlHelper.validate_token([user_id, start_date, end_date])
+    SqlHelper.validate_token([user_id])
+
+    start_s = start_date.strftime(Schedule::SYS_DATE_FORM)
+    end_s = end_date.strftime(Schedule::SYS_DATE_FORM)
 
-    sql = "SELECT COUNT(*) FROM timecards WHERE user_id = #{user_id} AND date >= '#{start_date}' AND date <= '#{end_date}'"
+    sql = "SELECT COUNT(*) FROM timecards WHERE user_id = #{user_id} AND date >= '#{start_s}' AND date <= '#{end_s}'"
 
     sum = 0.0
     self.workcodes.each do |key, params|
       paidhld_rate = params[WKCODE_PARAM_PAIDHLD]
       if paidhld_rate > 0.0
diff --git a/app/models/toy.rb b/app/models/toy.rb
index be06391..a0bf852 100644
--- a/app/models/toy.rb
+++ b/app/models/toy.rb
@@ -192,10 +192,12 @@ class Toy < ActiveRecord::Base
   #
   def self.on_desktop?(user, xtype, target_id)
 
     return false if user.nil? or xtype.nil? or target_id.nil?
 
+    SqlHelper.validate_token([xtype, target_id])
+
     con = "(user_id=#{user.id}) and (xtype='#{xtype}') and (target_id=#{target_id})"
 
     begin
       toy = Toy.where(con).first
     rescue => evar
diff --git a/app/models/user.rb b/app/models/user.rb
index 2225c92..bf4f46b 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -273,10 +273,12 @@ class User < ActiveRecord::Base
     return nil if attrs.nil? or attrs[:name].nil? or attrs[:password].nil?
 
     name = attrs[:name]
     password = attrs[:password]
 
+    SqlHelper.validate_token([name])
+
     pass_md5 = UsersHelper.generate_digest_pass(name, password)
 
     return User.where("(name='#{name}') and (pass_md5='#{pass_md5}')").first
   end
 
@@ -527,10 +529,12 @@ class User < ActiveRecord::Base
   #_user_name_:: Target User name
   #return:: User.
   #
   def self.get_from_name(user_name)
 
+    SqlHelper.validate_token([user_name])
+
     begin
       user = User.where("name='#{user_name}'").first
     rescue => evar
       Log.add_error(nil, evar)
     end
@@ -773,11 +777,12 @@ class User < ActiveRecord::Base
   #_user_id_:: Target User-ID.
   #return:: Folder object of 'My Folder'.
   #
   def self.get_my_folder(user_id)
 
-    return Folder.where("(owner_id=#{user_id}) and (xtype='#{Folder::XTYPE_USER}')").first
+   SqlHelper.validate_token([user_id])
+   return Folder.where("(owner_id=#{user_id}) and (xtype='#{Folder::XTYPE_USER}')").first
   end
 
   #=== create_my_folder
   #
   #Creates 'My Folder' of this User.
@@ -1154,10 +1159,11 @@ class User < ActiveRecord::Base
       con = nil
     else
       con = ['title=?', title]
     end
 
+    SqlHelper.validate_token([order])
     User.update_all("xorder=#{order}", con)
   end
 
   #=== rename_title
   #
@@ -1180,10 +1186,12 @@ class User < ActiveRecord::Base
   #_item_id_:: Item-ID of the project definition.
   #return:: Comment if exist, nil otherwise.
   #
   def get_project_application(item_id)
 
+    SqlHelper.validate_token([item_id])
+
     con = "(item_id=#{item_id}) and (user_id=#{self.id}) and (xtype='#{Comment::XTYPE_APPLY}')"
     begin
       comment = Comment.where(con).first
     rescue
     end
diff --git a/app/views/common/_edit_scope.html.erb b/app/views/common/_edit_scope.html.erb
index adf3ef7..5ecc78a 100644
--- a/app/views/common/_edit_scope.html.erb
+++ b/app/views/common/_edit_scope.html.erb
@@ -1,11 +1,11 @@
 
 <script type="text/javascript">
 scope_tabs = new Array("groups", "teams");
 </script>
 
-<table cellspacing="0" cellpadding="0" style="width:100%;">
+<table style="width:100%; border-spacing:0px;">
   <tr>
     <td style="vertical-align:top;">
       <table cellspacing="2" cellpadding="0" style="width:100%;">
         <tr style="height:20px;">
           <td id="tab_groups" class="td_item_tab" nowrap onclick="showTab('groups', scope_tabs, 'forestgreen');">
@@ -21,11 +21,11 @@ scope_tabs = new Array("groups", "teams");
 
   <tr>
     <td style="border:solid 1px gray; background-color:#FFFAFD;">
 
       <div id="tab_div_groups" style="display:none;">
-        <table cellspacing="0" cellpadding="0" style="width:100%; padding:5px 10px;">
+        <table style="width:100%; padding:5px 10px; border-spacing:0px;">
           <tr>
             <td>
               <%
               groups = Group.where(nil).to_a
               groups_selected = (obj.nil?)?([]):(obj.get_groups_a)
@@ -43,11 +43,11 @@ scope_tabs = new Array("groups", "teams");
             </td>
           </tr>
           <tr style="height:5px;"><td></td></tr>
           <tr>
             <td>
-              <table cellspacing="0" cellpadding="0" style="width:100%;">
+              <table style="width:100%; border-spacing:0px;">
                 <tr>
                   <td style="text-align:left; vertical-align:bottom; width:33%;"  >
                     <%= t('group.plural') %><%= t('cap.suffix') %>
                   </td>
                   <td style="text-align:center; width:34%;"  nowrap>
@@ -70,11 +70,11 @@ scope_tabs = new Array("groups", "teams");
             </td>
           </tr>
         </table>
       </div>
       <div id="tab_div_teams" style="display:none;">
-        <table cellspacing="0" cellpadding="0" style="width:100%; padding:5px 10px;">
+        <table style="width:100%; padding:5px 10px; border-spacing:0px;">
           <tr>
             <td>
               <%
               target_user_id = (@login_user.admin?(User::AUTH_TEAM))?(nil):(@login_user.id)
               teams = Team.get_for(target_user_id, true)
@@ -92,11 +92,11 @@ scope_tabs = new Array("groups", "teams");
             </td>
           </tr>
           <tr style="height:5px;"><td></td></tr>
           <tr>
             <td>
-              <table cellspacing="0" cellpadding="0" style="width:100%;">
+              <table style="width:100%; border-spacing:0px;">
                 <tr>
                   <td style="text-align:left; vertical-align:bottom; width:33%;" >
                     <%= t('team.plural') %><%= t('cap.suffix') %>
                   </td>
                   <td style="text-align:center; width:34%;" nowrap>
diff --git a/app/views/schedules/_edit_members.html.erb b/app/views/schedules/_edit_members.html.erb
index fa8e285..b2f84aa 100644
--- a/app/views/schedules/_edit_members.html.erb
+++ b/app/views/schedules/_edit_members.html.erb
@@ -25,11 +25,11 @@ tabs = new Array("users", "groups", "teams");
 
   <tr>
     <td style="border:solid 1px gray; background-color:#FFFAFD;">
 
       <div id="tab_div_users">
-        <table cellspacing="0" cellpadding="0" style="width:100%; padding:5px 10px;">
+        <table style="width:100%; padding:5px 10px; border-spacing:0px;">
           <tr>
             <td>
               <select id="users_selected" name="users[]" class="select_multi" size="5" multiple="multiple">
               <%
               @users_selected = @schedule.get_users_a
@@ -50,11 +50,11 @@ tabs = new Array("users", "groups", "teams");
             </td>
           </tr>
         </table>
       </div>
       <div id="tab_div_groups" style="display:none;">
-        <table cellspacing="0" cellpadding="0" style="width:100%; padding:5px 10px;">
+        <table style="width:100%; padding:5px 10px; border-spacing:0px;">
           <tr>
             <td>
               <%
               groups = Group.where(nil).to_a
               groups_selected = @schedule.get_groups_a
@@ -72,11 +72,11 @@ tabs = new Array("users", "groups", "teams");
             </td>
           </tr>
           <tr style="height:5px;"><td></td></tr>
           <tr>
             <td>
-              <table cellspacing="0" cellpadding="0" style="width:100%;">
+              <table style="width:100%; border-spacing:0px;">
                 <tr>
                   <td style="text-align:left; vertical-align:bottom; width:33%;"  >
                     <%= t('group.plural') %><%= t('cap.suffix') %>
                   </td>
                   <td style="text-align:center; width:34%;"  nowrap>
@@ -99,11 +99,11 @@ tabs = new Array("users", "groups", "teams");
             </td>
           </tr>
         </table>
       </div>
       <div id="tab_div_teams" style="display:none;">
-        <table cellspacing="0" cellpadding="0" style="width:100%; padding:5px 10px;">
+        <table style="width:100%; padding:5px 10px; border-spacing:0px;">
           <tr>
             <td>
               <%
               target_user_id = (@login_user.admin?(User::AUTH_TEAM))?(nil):(@login_user.id)
               teams = Team.get_for(target_user_id, true)
@@ -121,11 +121,11 @@ tabs = new Array("users", "groups", "teams");
             </td>
           </tr>
           <tr style="height:5px;"><td></td></tr>
           <tr>
             <td>
-              <table cellspacing="0" cellpadding="0" style="width:100%;">
+              <table style="width:100%; border-spacing:0px;">
                 <tr>
                   <td style="text-align:left; vertical-align:bottom; width:33%;" >
                     <%= t('team.plural') %><%= t('cap.suffix') %>
                   </td>
                   <td style="text-align:center; width:34%;" nowrap>
diff --git a/app/views/send_mails/edit_send_to.html.erb b/app/views/send_mails/edit_send_to.html.erb
index df3c069..143862e 100644
--- a/app/views/send_mails/edit_send_to.html.erb
+++ b/app/views/send_mails/edit_send_to.html.erb
@@ -87,11 +87,11 @@ tabs_send_mail_address.push("users");
                   else
                     disp = "#{screenname} "
                   end
                   disp << "<#{mail_addr}>"
 
-                  user = User.where("email='#{mail_addr}'").first
+                  user = User.where(email: mail_addr).first
                   if user.nil?
                     entry_val = disp
                   else
                     entry_val = "#{disp}#{Email::ADDR_ORDER_SEPARATOR}#{user.get_xorder(nil)}"
                   end
diff --git a/app/views/timecards/group.html.erb b/app/views/timecards/group.html.erb
index 20bb515..5e25b65 100644
--- a/app/views/timecards/group.html.erb
+++ b/app/views/timecards/group.html.erb
@@ -1,8 +1,9 @@
 <% HistoryHelper.set_back(request) %>
-
-<% date_s = @date.strftime(Schedule::SYS_DATE_FORM) unless @date.nil? %>
+<%
+date_s = @date.strftime(Schedule::SYS_DATE_FORM) unless @date.nil?
+%>
 
 <%= render(:partial => 'common/jkl_calendar_init') %>
 
 <script type="text/javascript">
 
@@ -74,11 +75,11 @@ next_week = @date + 7
 else
   yaml = ApplicationHelper.get_config_yaml
   @selected_users.each_with_index do |user, idx|
     bgcolor = (idx % 2 == 1) ? 'gainsboro' : 'white'
 
-    timecard = Timecard.get_for(user.id, @date)
+    timecard = Timecard.get_for(user.id, date_s)
     timecard = Timecard.new if timecard.nil?
 %>
   <tr style="background-color:<%= bgcolor %>;">
     <td style="text-align:center;">
       <a class="a_underline" href="#" onclick="prog('TOP-RIGHT'); location.href='<%= url_for(:controller => 'timecards', :action => 'month', :date => date_s, :user_id => user.id, :display => params[:display]) %>'; return false;">

Vulnerable code:     if date_s.nil? or date_s.empty?
    end 
        @team.add_users team_members
        @team.remove_application team_members
    SqlHelper.validate_token([mail_addr], ['@-'])
      SqlHelper.validate_token([account_xtype])
    if date_s.nil? or date_s.empty?
    SqlHelper.validate_token([params[:user_id], params[:zeptair_id], params[:group_id]])
    unless params[:user_id].blank?
      target_user = User.find(params[:user_id])
    unless params[:zeptair_id].blank?
      zeptair_id = params[:zeptair_id]
      if params[:group_id].blank?
        group_ids = [params[:group_id]]
          group_ids += Group.get_childs(params[:group_id], true, false)
        group_ids.each do |group_id|
          groups_con << SqlHelper.get_sql_like(['User.groups'], "|#{@group_id}|")
    unless params[:user_id].blank?
      if @login_user.admin?(User::AUTH_ZEPTAIR) or @login_user.id.to_s == params[:user_id].to_s
        target_user = User.find(params[:user_id])
    unless params[:zeptair_id].blank?
      target_user = User.where("zeptair_id=#{params[:zeptair_id]}").first
      if params[:attachment_id].blank?
        attach = Attachment.find(params[:attachment_id])
    return '#' + sprintf('%03d', rev+1)
    extra_chars = Regexp.escape((extra_chars || []).join())
    regexp = Regexp.new("^[ ]*[a-zA-Z0-9_.#{extra_chars}]+[ ]*$")

    account_ary = MailAccount.find_by_sql('select * from mail_accounts ' + where + ' order by xorder ASC, title ASC')
    if account_ary.nil? or account_ary.empty?
      return account_ary.first
      PaidHoliday.destroy_all(['user_id=? and year=?', user_id, fiscal_year])

  #_users_:: Array of User-IDs.
  def remove_application(users)
    return if users.nil? or users.empty?
    array = ["(xtype='#{Comment::XTYPE_APPLY}')"]
    array << "(item_id=#{self.item_id})"
    users.each do |user_id|
    array << '(' + user_con_a.join(' or ') + ')'
    Comment.destroy_all(array.join(' and '))

  #_date_:: Target Date.
  def self.get_for(user_id, date)
      con = "(user_id=#{user_id}) and (date='#{date}')"
    con = "(user_id=#{user_id}) and (date >= '#{start_date}') and (date <= '#{end_date}')"
    SqlHelper.validate_token([user_id, start_date, end_date])
    sql = "SELECT COUNT(*) FROM timecards WHERE user_id = #{user_id} AND date >= '#{start_date}' AND date <= '#{end_date}'"
    return Folder.where("(owner_id=#{user_id}) and (xtype='#{Folder::XTYPE_USER}')").first
<table cellspacing="0" cellpadding="0" style="width:100%;">
        <table cellspacing="0" cellpadding="0" style="width:100%; padding:5px 10px;">
              <table cellspacing="0" cellpadding="0" style="width:100%;">
        <table cellspacing="0" cellpadding="0" style="width:100%; padding:5px 10px;">
              <table cellspacing="0" cellpadding="0" style="width:100%;">
        <table cellspacing="0" cellpadding="0" style="width:100%; padding:5px 10px;">
        <table cellspacing="0" cellpadding="0" style="width:100%; padding:5px 10px;">
              <table cellspacing="0" cellpadding="0" style="width:100%;">
        <table cellspacing="0" cellpadding="0" style="width:100%; padding:5px 10px;">
              <table cellspacing="0" cellpadding="0" style="width:100%;">
                  user = User.where("email='#{mail_addr}'").first

<% date_s = @date.strftime(Schedule::SYS_DATE_FORM) unless @date.nil? %>
    timecard = Timecard.get_for(user.id, @date)
Fixed code:     if date_s.blank?
    end
    SqlHelper.validate_token([team_members])
        @team.add_users(team_members)
        @team.remove_application(team_members)
    SqlHelper.validate_token([mail_addr])
    SqlHelper.validate_token([account_xtype])
    if date_s.blank?
    user_id = params[:user_id]
    zeptair_id = params[:zeptair_id]
    group_id = params[:group_id]
    SqlHelper.validate_token([user_id, zeptair_id, group_id])
    unless user_id.blank?
      target_user = User.find(user_id)
    unless zeptair_id.blank?
      if group_id.blank?
        group_ids = [group_id]
          group_ids += Group.get_childs(group_id, true, false)
        group_ids.each do |grp_id|
          groups_con << SqlHelper.get_sql_like(['User.groups'], "|#{grp_id}|")
    user_id = params[:user_id]
    zeptair_id = params[:zeptair_id]
    attachment_id = params[:attachment_id]
    SqlHelper.validate_token([user_id, zeptair_id, attachment_id])

    unless user_id.blank?
      if @login_user.admin?(User::AUTH_ZEPTAIR) or @login_user.id.to_s == user_id.to_s
        target_user = User.find(user_id)
    unless zeptair_id.blank?
      target_user = User.where("zeptair_id=#{zeptair_id}").first
      if attachment_id.blank?
        attach = Attachment.find(attachment_id)

    SqlHelper.validate_token([user_id, source_id])

    return ('#' + sprintf('%03d', rev+1))
    if extra_chars.nil?
      extra_chars = ''
    else
      extra_chars = Regexp.escape(extra_chars.join())
    end
    regexp = Regexp.new("^[ ]*[a-zA-Z0-9_.@\\-#{extra_chars}]+[ ]*$")
    SqlHelper.validate_token([name])

    SqlHelper.validate_token([node_id])

    SqlHelper.validate_token([node_id])
    SqlHelper.validate_token([item_id, user_id])
    SqlHelper.validate_token([item_id])
    SqlHelper.validate_token([item_id])
    SqlHelper.validate_token([mail_addr])


    SqlHelper.validate_token([user_id, mail_account_id])

    SqlHelper.validate_token([user_id])

    SqlHelper.validate_token([folder_id])
    SqlHelper.validate_token([group_id])
    SqlHelper.validate_token([group_id])
    SqlHelper.validate_token([user_id])

    mail_accounts = MailAccount.find_by_sql('select * from mail_accounts ' + where + ' order by xorder ASC, title ASC')
    if mail_accounts.nil? or mail_accounts.empty?
      return mail_accounts.first
    SqlHelper.validate_token([user_id, mail_account_id, xtype])

    SqlHelper.validate_token([user_id])


    SqlHelper.validate_token([user_id, fiscal_year])

    SqlHelper.validate_token([user_id, fiscal_year])

      con = []
      con << "(user_id=#{user_id})"
      con << "(year=#{fiscal_year})"
      PaidHoliday.destroy_all(con.join(' and '))
    SqlHelper.validate_token([user_id, year])

    SqlHelper.validate_token([user_id])

    SqlHelper.validate_token([user_id, category])

    SqlHelper.validate_token([user_id, category, key])

    SqlHelper.validate_token([user_id, category, key])

    SqlHelper.validate_token([group_id, category])

    SqlHelper.validate_token([group_id, category, key])

    SqlHelper.validate_token([group_id, category, key])

    SqlHelper.validate_token([team_id])
  #_user_ids_:: Array of User-IDs.
  def remove_application(user_ids)
    return if user_ids.nil? or user_ids.empty?
    SqlHelper.validate_token([user_ids])

    con = ["(xtype='#{Comment::XTYPE_APPLY}')"]
    con << "(item_id=#{self.item_id})"
    user_ids.each do |user_id|
    con << '(' + user_con_a.join(' or ') + ')'
    Comment.destroy_all(con.join(' and '))
  #_date_s_:: Target Date string.
  def self.get_for(user_id, date_s)

    SqlHelper.validate_token([user_id, date_s])
      con = "(user_id=#{user_id}) and (date='#{date_s}')"

    SqlHelper.validate_token([user_id])

    start_s = start_date.strftime(Schedule::SYS_DATE_FORM)
    end_s = end_date.strftime(Schedule::SYS_DATE_FORM)

    con = "(user_id=#{user_id}) and (date >= '#{start_s}') and (date <= '#{end_s}')"
    SqlHelper.validate_token([user_id])

    start_s = start_date.strftime(Schedule::SYS_DATE_FORM)
    end_s = end_date.strftime(Schedule::SYS_DATE_FORM)
    sql = "SELECT COUNT(*) FROM timecards WHERE user_id = #{user_id} AND date >= '#{start_s}' AND date <= '#{end_s}'"
    SqlHelper.validate_token([xtype, target_id])

    SqlHelper.validate_token([name])

    SqlHelper.validate_token([user_name])

   SqlHelper.validate_token([user_id])
   return Folder.where("(owner_id=#{user_id}) and (xtype='#{Folder::XTYPE_USER}')").first
    SqlHelper.validate_token([order])
    SqlHelper.validate_token([item_id])

<table style="width:100%; border-spacing:0px;">
        <table style="width:100%; padding:5px 10px; border-spacing:0px;">
              <table style="width:100%; border-spacing:0px;">
        <table style="width:100%; padding:5px 10px; border-spacing:0px;">
              <table style="width:100%; border-spacing:0px;">
        <table style="width:100%; padding:5px 10px; border-spacing:0px;">
        <table style="width:100%; padding:5px 10px; border-spacing:0px;">
              <table style="width:100%; border-spacing:0px;">
        <table style="width:100%; padding:5px 10px; border-spacing:0px;">
              <table style="width:100%; border-spacing:0px;">
                  user = User.where(email: mail_addr).first
<%
date_s = @date.strftime(Schedule::SYS_DATE_FORM) unless @date.nil?
%>
    timecard = Timecard.get_for(user.id, date_s)