tryton-do/tryton
2
0 Fork 0
Code Issues Pull Requests 2 Actions 2 Packages Projects Releases Wiki Activity

Fix "not like" and "not ilike" operator for issue423

Browse Source 
Security fix SQL injection
This commit is contained in:
Cédric Krier committed 2009-03-30 10:20:31 +02:00
1 parent 2c3ab4db87
commit 68ca60ecd9
1 file changed
+26 -29
Download Patch File Download Diff File Expand all files Collapse all files
trytond/model/modelsql.py
+26 -29
View File
@@ -1485,42 +1485,39 @@ class ModelSQL(ModelStorage):
qu2.append(arg[2])
else:
add_null = False
if arg[1] in ('like', 'ilike', 'not like', 'not ilike'):
qu2.append('%% %s%%' % arg[2])
qu2.append('%s%%' % arg[2])
if arg[1] in ('like', 'ilike'):
if not arg[2]:
add_null = True
qu2.append('%')
qu2.append('%')
add_null = ' AND '
else:
qu2.append('%% %s%%' % arg[2])
qu2.append('%s%%' % arg[2])
elif arg[1] in ('not like', 'not ilike'):
if not arg[2]:
qu2.append('')
qu2.append('')
else:
qu2.append('%% %s%%' % arg[2])
qu2.append('%s%%' % arg[2])
add_null = ' OR '
else:
if arg[0] in table._columns:
qu2.append(FIELDS[table._columns[arg[0]]._type].\
sql_format(arg[2]))
if arg[0] in table._columns:
if arg[1] in ('like', 'ilike'):
qu1.append('("%s".%s %s %s OR "%s".%s %s %s)' % \
(table._table, arg[0], arg[1], '%s',
table._table, arg[0], arg[1], '%s'))
elif arg[1] in ('not like', 'not ilike'):
qu1.append('("%s".%s %s %s AND "%s".%s %s %s)' % \
(table._table, arg[0], arg[1], '%s',
table._table, arg[0], arg[1], '%s'))
else:
qu1.append('("%s".%s %s %%s)' % (table._table,
arg[0], arg[1]))
if arg[1] in ('like', 'ilike'):
qu1.append('("%s".%s %s %s OR "%s".%s %s %s)' % \
(table._table, arg[0], arg[1], '%s',
table._table, arg[0], arg[1], '%s'))
elif arg[1] in ('not like', 'not ilike'):
qu1.append('("%s".%s %s %s AND "%s".%s %s %s)' % \
(table._table, arg[0], arg[1], '%s',
table._table, arg[0], arg[1], '%s'))
else:
if arg[1] in ('like', 'ilike'):
qu1.append('("%s".%s %s \'%s\' or "%s".%s %s \'%s\')' % \
(table._table, arg[0], arg[1], arg[2],
table._table, arg[0], arg[1], arg[2]))
elif arg[1] in ('not like', 'not ilike'):
qu1.append('("%s".%s %s \'%s\' and "%s".%s %s \'%s\')' % \
(table._table, arg[0], arg[1], arg[2],
table._table, arg[0], arg[1], arg[2]))
else:
qu1.append('("%s".%s %s \'%s\')' % \
(table._table, arg[0], arg[1], arg[2]))
qu1.append('("%s".%s %s %%s)' % (table._table,
arg[0], arg[1]))
if add_null:
qu1[-1] = '(' + qu1[-1] + ' OR ' + \
qu1[-1] = '(' + qu1[-1] + add_null + \
'"' + table._table + '".' + arg[0] +' IS NULL)'
return qu1, qu2