Discource-C
/
discourse
mirror of https://github.com/discourse/discourse.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

DEV: Correct use of `sanitize_sql_array` in `TopicQuery`.

This commit is contained in:
Guo Xiang Tan 2020-09-08 12:30:09 +08:00
parent d3ebaa41ce
commit a1d135f12a
No known key found for this signature in database
GPG Key ID: FBD110179AAC1F20
1 changed files with 4 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
lib/topic_query.rb
View File

@ -145,7 +145,7 @@ class TopicQuery
# strip out users in groups you already belong to # strip out users in groups you already belong to
target_users = target_users target_users = target_users
.joins("LEFT JOIN group_users gu ON gu.user_id = topic_allowed_users.user_id AND gu.group_id IN (#{sanitize_sql_array(my_group_ids)})") .joins("LEFT JOIN group_users gu ON gu.user_id = topic_allowed_users.user_id AND #{ActiveRecord::Base.sanitize_sql_array(['gu.group_id IN (?)', my_group_ids])}")
.where('gu.group_id IS NULL') .where('gu.group_id IS NULL')
end end
@ -985,7 +985,7 @@ class TopicQuery
messages.joins(" messages.joins("
LEFT JOIN topic_allowed_users ta2 LEFT JOIN topic_allowed_users ta2
ON topics.id = ta2.topic_id ON topics.id = ta2.topic_id
AND ta2.user_id IN (#{sanitize_sql_array(user_ids)}) AND #{ActiveRecord::Base.sanitize_sql_array(['ta2.user_id IN (?)', user_ids])}
") ")
end end
@ -994,7 +994,7 @@ class TopicQuery
messages.joins(" messages.joins("
LEFT JOIN topic_allowed_groups tg2 LEFT JOIN topic_allowed_groups tg2
ON topics.id = tg2.topic_id ON topics.id = tg2.topic_id
AND tg2.group_id IN (#{sanitize_sql_array(group_ids)}) AND #{ActiveRecord::Base.sanitize_sql_array(['tg2.group_id IN (?)', group_ids])}
") ")
end end
@ -1017,7 +1017,7 @@ class TopicQuery
LEFT JOIN group_users gu LEFT JOIN group_users gu
ON gu.user_id = #{@user.id.to_i} ON gu.user_id = #{@user.id.to_i}
AND gu.group_id = _tg.group_id AND gu.group_id = _tg.group_id
WHERE gu.group_id IN (#{sanitize_sql_array(group_ids)}) WHERE #{ActiveRecord::Base.sanitize_sql_array(['gu.group_id IN (?)', group_ids])}
) tg ON topics.id = tg.topic_id ) tg ON topics.id = tg.topic_id
") ")
.where("tg.topic_id IS NOT NULL") .where("tg.topic_id IS NOT NULL")
@ -1090,10 +1090,6 @@ class TopicQuery
private private
def sanitize_sql_array(input)
ActiveRecord::Base.public_send(:sanitize_sql_array, input.join(','))
end
def append_read_state(list, group) def append_read_state(list, group)
group_id = group&.id group_id = group&.id
return list if group_id.nil? return list if group_id.nil?