vassili/seitime-frappe
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 4

Merge pull request #8015 from adityahase/revert-develop

Browse source 
fix: Revert recent security fixes
This commit is contained in:
mergify[bot] 2019-07-26 15:42:46 +00:00 • committed by GitHub
commit bdc0b7948d
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 1 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
frappe/model/db_query.py
View file

@ -240,9 +240,6 @@ class DatabaseQuery(object):
_is_query(field)
invalid_characters_regex = r".*[^a-zA-Z0-9-_ ,`'\"\*\.\(\)].*"
if re.match(invalid_characters_regex, field):
frappe.throw(_("Illegal characters in SQL query"))
def extract_tables(self):
"""extract tables from fields"""
@ -691,9 +688,6 @@ class DatabaseQuery(object):
if 'select' in _lower and ' from ' in _lower:
frappe.throw(_('Cannot use sub-query in order by'))
invalid_characters_regex = r".*[^a-z0-9-_ ,`'\"\.\(\)].*"
if re.match(invalid_characters_regex, _lower):
frappe.throw(_("Illegal characters in SQL query"))
for field in parameters.split(","):
if "." in field and field.strip().startswith("`tab"):

2
frappe/utils/jinja.py
View file

@ -71,7 +71,7 @@ def render_template(template, context, is_path=None, safe_render=True):
or (template.endswith('.html') and '\n' not in template)):
return get_jenv().get_template(template).render(context)
else:
if safe_render and "__" in template:
if safe_render and ".__" in template:
throw("Illegal template")
try:
return get_jenv().from_string(template).render(context)