mirror of
https://git.vectorsigma.ru/public/photoview.git
synced 2026-08-01 02:18:58 +00:00
53b323640f
In order to prevent SQL injections and , reveal information about the database tables avoid passing MySQL functions as GQL sorting parameters, I refactored the FormatSQL() function. Additionally, the old approach with using regex to filter the orderBy parameter was not effective and prevented using column.table annotations.
49 lines
1.1 KiB
Go
49 lines
1.1 KiB
Go
package models
|
|
|
|
import (
|
|
"fmt"
|
|
"log"
|
|
)
|
|
|
|
func (filter *Filter) FormatSQL(context string) (string, error) {
|
|
if filter == nil {
|
|
return "", nil
|
|
}
|
|
|
|
orderByMap := make(map[string]string)
|
|
orderByMap["media_date_shot"] = "media.date_shot"
|
|
orderByMap["media_date_imported"] = "media.date_imported"
|
|
orderByMap["media_title"] = "media.title"
|
|
orderByMap["media_kind"] = "media.media_type, SUBSTRING_INDEX(media.path, '.', -1)"
|
|
orderByMap["album_title"] = "album.title"
|
|
|
|
result := ""
|
|
|
|
if filter.OrderBy != nil {
|
|
order_by, ok := orderByMap[context+"_"+*filter.OrderBy]
|
|
if !ok {
|
|
log.Printf("Invalid order column: '%s'\n", *filter.OrderBy)
|
|
return "", nil
|
|
}
|
|
|
|
direction := "ASC"
|
|
if filter.OrderDirection != nil && filter.OrderDirection.IsValid() {
|
|
direction = filter.OrderDirection.String()
|
|
}
|
|
|
|
result += fmt.Sprintf(" ORDER BY %s %s", order_by, direction)
|
|
}
|
|
|
|
if filter.Limit != nil {
|
|
offset := 0
|
|
if filter.Offset != nil && *filter.Offset >= 0 {
|
|
offset = *filter.Offset
|
|
}
|
|
|
|
result += fmt.Sprintf(" LIMIT %d OFFSET %d", *filter.Limit, offset)
|
|
}
|
|
|
|
log.Printf("SQL Filter: '%s'\n", result)
|
|
return result, nil
|
|
}
|