innov
/
nightingale
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

bugfix: insert task_meta sql inject

This commit is contained in:
UlricQin 2020-12-31 13:01:43 +08:00
parent e903f609a5
commit 6dbbbac344
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/models/task_meta.go
View File

@ -151,8 +151,8 @@ func (m *TaskMeta) Save(hosts []string, action string) error {
}
for _, host := range hosts {
sql := fmt.Sprintf("INSERT INTO %s(id, host, status) VALUES(%d, '%s', 'waiting')", tht(id), id, host)
if _, err := session.Exec(sql); err != nil {
sql := fmt.Sprintf("INSERT INTO %s(id, host, status) VALUES(%d, ?, 'waiting')", tht(id), id)
if _, err := session.Exec(sql, host); err != nil {
session.Rollback()
return err
}