innov
/
nightingale1
1
0
Fork 0
Code Issues Pull Requests 1 Projects Releases Wiki Activity

fix sql inject

This commit is contained in:
UlricQin 2021-01-12 18:38:12 +08:00
parent 7161c1ac4e
commit 903a1654b6
1 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
src/models/node.go
View File

@ -411,14 +411,19 @@ func (n *Node) RoleList(username string, limit, offset int) ([]NodeRole, error)
sql = fmt.Sprintf(sql, n.Id, n.Path+".%") sql = fmt.Sprintf(sql, n.Id, n.Path+".%")
var args []interface{}
if username != "" { if username != "" {
sql += fmt.Sprintf(" and node_role.username = '%s'", username) sql += fmt.Sprintf(" and node_role.username = ?")
args = append(args, username)
} }
sql += " order by node.path limit ? offset ?" sql += " order by node.path limit ? offset ?"
args = append(args, limit)
args = append(args, offset)
var objs []NodeRole var objs []NodeRole
err := DB["rdb"].SQL(sql, limit, offset).Find(&objs) err := DB["rdb"].SQL(sql, args...).Find(&objs)
return objs, err return objs, err
} }