innov
/
nightingale1
1
0
Fork 0
Code Issues Pull Requests 1 Projects Releases Wiki Activity

bugfix: insert task_meta sql inject

This commit is contained in:
UlricQin 2020-12-31 13:01:43 +08:00
parent e903f609a5
commit 6dbbbac344
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/models/task_meta.go
View File

@ -151,8 +151,8 @@ func (m *TaskMeta) Save(hosts []string, action string) error {
} }
for _, host := range hosts { for _, host := range hosts {
sql := fmt.Sprintf("INSERT INTO %s(id, host, status) VALUES(%d, '%s', 'waiting')", tht(id), id, host) sql := fmt.Sprintf("INSERT INTO %s(id, host, status) VALUES(%d, ?, 'waiting')", tht(id), id)
if _, err := session.Exec(sql); err != nil { if _, err := session.Exec(sql, host); err != nil {
session.Rollback() session.Rollback()
return err return err
} }