vassili/seitime-frappe
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

feat(minor): allow frappe.db.sql for read in server script

Browse source
This commit is contained in:
Rushabh Mehta 2020-08-20 18:33:29 +05:30
parent 5a74047ca3
commit 275a70e9d0
2 changed files with 17 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
frappe/tests/test_safe_exec.py
View file

@ -1,5 +1,5 @@
from __future__ import unicode_literals
import unittest
import unittest, frappe
from frappe.utils.safe_exec import safe_exec
class TestSafeExec(unittest.TestCase):
@ -7,4 +7,11 @@ class TestSafeExec(unittest.TestCase):
self.assertRaises(ImportError, safe_exec, 'import os')
def test_internal_attributes(self):
self.assertRaises(SyntaxError, safe_exec, '().__class__.__call__')
self.assertRaises(SyntaxError, safe_exec, '().__class__.__call__')
def test_sql(self):
_locals = dict(out=None)
safe_exec('''out = frappe.db.sql("select name from tabDocType where name='DocType'")''', None, _locals)
self.assertEqual(_locals['out'][0][0], 'DocType')
self.assertRaises(frappe.PermissionError, safe_exec, 'frappe.db.sql("update tabToDo set description=NULL")')

8
frappe/utils/safe_exec.py
View file

@ -114,6 +114,7 @@ def get_safe_globals():
get_single_value = frappe.db.get_single_value,
get_default = frappe.db.get_default,
escape = frappe.db.escape,
sql = read_sql
)
if frappe.response:
@ -132,6 +133,13 @@ def get_safe_globals():
return out
def read_sql(query, *args, **kwargs):
'''a wrapper for frappe.db.sql to allow reads'''
if query.strip().split(None, 1)[0].lower() == 'select':
return frappe.db.sql(query, *args, **kwargs)
else:
raise frappe.PermissionError('Only SELECT SQL allowed in scripting')
def _getitem(obj, key):
# guard function for RestrictedPython
# allow any key to be accessed as long as it does not start with underscore