vassili/seitime-frappe
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

Merge branch 'staging-fixes' into staging

Browse source
This commit is contained in:
Ameya Shenoy 2018-10-31 10:46:24 +00:00
commit ca72c772f1
No known key found for this signature in database
GPG key ID: AC016A555657D0A3
4 changed files with 24 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
frappe/__init__.py
View file

@ -17,7 +17,7 @@ from faker import Faker
from .exceptions import *
from .utils.jinja import (get_jenv, get_template, render_template, get_email_from_template, get_jloader)
__version__ = '10.1.57'
__version__ = '10.1.58'
__title__ = "Frappe Framework"
local = Local()

2
frappe/hooks.py
View file

@ -12,7 +12,7 @@ source_link = "https://github.com/frappe/frappe"
app_license = "MIT"
develop_version = '11.x.x-develop'
staging_version = '11.0.3-beta.17'
staging_version = '11.0.3-beta.18'
app_email = "info@frappe.io"

15
frappe/model/db_query.py
View file

@ -191,13 +191,21 @@ class DatabaseQuery(object):
'''
sub_query_regex = re.compile("^.*[,();].*")
blacklisted_keywords = ['select', 'create', 'insert', 'delete', 'drop', 'update', 'case']
blacklisted_keywords = ['select', 'create', 'insert', 'delete', 'drop', 'update', 'case',
'from', 'group', 'order', 'by']
blacklisted_functions = ['concat', 'concat_ws', 'if', 'ifnull', 'nullif', 'coalesce',
'connection_id', 'current_user', 'database', 'last_insert_id', 'session_user',
'system_user', 'user', 'version']
def _raise_exception():
frappe.throw(_('Cannot use sub-query or function in fields'), frappe.DataError)
frappe.throw(_('Use of sub-query or function is restricted'), frappe.DataError)
def _is_query(field):
if re.compile("^(select|delete|update|drop|create)\s").match(field):
_raise_exception()
elif re.compile("\s*[a-zA-z]*\s*( from | group by | order by | where | join )").match(field):
_raise_exception()
for field in self.fields:
if sub_query_regex.match(field):
@ -216,6 +224,9 @@ class DatabaseQuery(object):
if re.compile('[a-zA-Z]+\s*,').match(field):
_raise_exception()
_is_query(field)
def extract_tables(self):
"""extract tables from fields"""
self.tables = ['`tab' + self.doctype + '`']

9
frappe/tests/test_db_query.py
View file

@ -124,6 +124,15 @@ class TestReportview(unittest.TestCase):
self.assertRaises(frappe.DataError, DatabaseQuery("DocType").execute,
fields=["name", "issingle,'"],limit_start=0, limit_page_length=1)
self.assertRaises(frappe.DataError, DatabaseQuery("DocType").execute,
fields=["name", "select * from tabSessions"],limit_start=0, limit_page_length=1)
self.assertRaises(frappe.DataError, DatabaseQuery("DocType").execute,
fields=["name", "issingle from --"],limit_start=0, limit_page_length=1)
self.assertRaises(frappe.DataError, DatabaseQuery("DocType").execute,
fields=["name", "issingle from tabDocType order by 2 --"],limit_start=0, limit_page_length=1)
data = DatabaseQuery("DocType").execute(fields=["name", "issingle", "count(name)"],
limit_start=0, limit_page_length=1)
self.assertTrue('count(name)' in data[0])