vassili/seitime-frappe
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

Merge branch 'hotfix'

Browse source
This commit is contained in:
Ameya Shenoy 2018-10-31 10:36:54 +00:00
commit a26dd436f5
No known key found for this signature in database
GPG key ID: AC016A555657D0A3
3 changed files with 23 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
frappe/__init__.py
View file

@ -14,7 +14,7 @@ import os, sys, importlib, inspect, json
from .exceptions import *
from .utils.jinja import get_jenv, get_template, render_template, get_email_from_template
__version__ = '10.1.57'
__version__ = '10.1.58'
__title__ = "Frappe Framework"
local = Local()

15
frappe/model/db_query.py
View file

@ -192,13 +192,21 @@ class DatabaseQuery(object):
'''
sub_query_regex = re.compile("^.*[,();].*")
blacklisted_keywords = ['select', 'create', 'insert', 'delete', 'drop', 'update', 'case']
blacklisted_keywords = ['select', 'create', 'insert', 'delete', 'drop', 'update', 'case',
'from', 'group', 'order', 'by']
blacklisted_functions = ['concat', 'concat_ws', 'if', 'ifnull', 'nullif', 'coalesce',
'connection_id', 'current_user', 'database', 'last_insert_id', 'session_user',
'system_user', 'user', 'version']
def _raise_exception():
frappe.throw(_('Cannot use sub-query or function in fields'), frappe.DataError)
frappe.throw(_('Use of sub-query or function is restricted'), frappe.DataError)
def _is_query(field):
if re.compile("^(select|delete|update|drop|create)\s").match(field):
_raise_exception()
elif re.compile("\s*[a-zA-z]*\s*( from | group by | order by | where | join )").match(field):
_raise_exception()
for field in self.fields:
if sub_query_regex.match(field):
@ -217,6 +225,9 @@ class DatabaseQuery(object):
if re.compile('[a-zA-Z]+\s*,').match(field):
_raise_exception()
_is_query(field)
def extract_tables(self):
"""extract tables from fields"""
self.tables = ['`tab' + self.doctype + '`']

9
frappe/tests/test_db_query.py
View file

@ -123,6 +123,15 @@ class TestReportview(unittest.TestCase):
self.assertRaises(frappe.DataError, DatabaseQuery("DocType").execute,
fields=["name", "issingle,'"],limit_start=0, limit_page_length=1)
self.assertRaises(frappe.DataError, DatabaseQuery("DocType").execute,
fields=["name", "select * from tabSessions"],limit_start=0, limit_page_length=1)
self.assertRaises(frappe.DataError, DatabaseQuery("DocType").execute,
fields=["name", "issingle from --"],limit_start=0, limit_page_length=1)
self.assertRaises(frappe.DataError, DatabaseQuery("DocType").execute,
fields=["name", "issingle from tabDocType order by 2 --"],limit_start=0, limit_page_length=1)
data = DatabaseQuery("DocType").execute(fields=["name", "issingle", "count(name)"],
limit_start=0, limit_page_length=1)
self.assertTrue('count(name)' in data[0])