WEBDIENSTE/huly-platform
1
0
Fork 0
mirror of https://github.com/hcengineering/platform.git synced 2026-09-09 11:17:43 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix pg escape (#7187)

Browse Source 
Signed-off-by: Denis Bykhov <bykhov.denis@gmail.com>
This commit is contained in:
Denis Bykhov
2024-11-18 23:29:52 +07:00
committed by GitHub
parent 5353a06b07
commit 641e72fc0d
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/postgres/src/storage.ts
+2 -2
View File
@@ -484,7 +484,7 @@ abstract class PostgresAdapterBase implements DbAdapter {
const key = domain === DOMAIN_SPACE ? '_id' : domain === DOMAIN_TX ? "data ->> 'objectSpace'" : 'space'
const privateCheck = domain === DOMAIN_SPACE ? ' OR sec.private = false' : ''
const q = `(sec.members @> '{"${acc._id}"}' OR sec."_class" = '${core.class.SystemSpace}'${privateCheck})`
return `INNER JOIN ${translateDomain(DOMAIN_SPACE)} AS sec ON sec._id = ${domain}.${key} AND sec."workspaceId" = '${this.workspaceId.name}' AND ${q}`
return `INNER JOIN ${translateDomain(DOMAIN_SPACE)} AS sec ON sec._id = ${domain}.${escapeBackticks(key)} AND sec."workspaceId" = '${this.workspaceId.name}' AND ${q}`
}
}
}
@@ -1019,7 +1019,7 @@ abstract class PostgresAdapterBase implements DbAdapter {
res.push(`${tkey} IS ${val === true ? 'NOT NULL' : 'NULL'}`)
break
case '$regex':
res.push(`${tkey} SIMILAR TO '${val}'`)
res.push(`${tkey} SIMILAR TO '${escapeBackticks(val)}'`)
break
case '$options':
break