github/directus
1
1
Fork 0
mirror of https://github.com/directus/directus.git synced 2026-04-25 03:00:53 -04:00
Code Issues Packages Projects Releases Wiki Activity

sanitize query in item read/update/delete (#13900)

Browse Source
This commit is contained in:
Azri Kahar
2022-06-15 20:13:22 +08:00
committed by GitHub
parent 92d506ca92
commit 7cefbc9430
3 changed files with 14 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
api/src/operations/item-delete/index.ts
View File

@@ -1,8 +1,9 @@
import { Accountability, PrimaryKey } from '@directus/shared/types';
import { defineOperationApi, toArray } from '@directus/shared/utils';
import { ItemsService } from '../../services';
import { optionToObject } from '../../utils/operation-options';
import { getAccountabilityForRole } from '../../utils/get-accountability-for-role';
import { optionToObject } from '../../utils/operation-options';
import { sanitizeQuery } from '../../utils/sanitize-query';
type Options = {
collection: string;
@@ -36,11 +37,12 @@ export default defineOperationApi<Options>({
});
const queryObject = query ? optionToObject(query) : {};
const sanitizedQueryObject = sanitizeQuery(queryObject, customAccountability);
let result: PrimaryKey | PrimaryKey[] | null;
if (!key) {
result = await itemsService.deleteByQuery(queryObject);
result = await itemsService.deleteByQuery(sanitizedQueryObject);
} else {
const keys = toArray(key);

10
api/src/operations/item-read/index.ts
View File

@@ -2,8 +2,9 @@ import { Accountability, PrimaryKey } from '@directus/shared/types';
import { defineOperationApi, toArray } from '@directus/shared/utils';
import { ItemsService } from '../../services';
import { Item } from '../../types';
import { optionToObject } from '../../utils/operation-options';
import { getAccountabilityForRole } from '../../utils/get-accountability-for-role';
import { optionToObject } from '../../utils/operation-options';
import { sanitizeQuery } from '../../utils/sanitize-query';
type Options = {
collection: string;
@@ -37,18 +38,19 @@ export default defineOperationApi<Options>({
});
const queryObject = query ? optionToObject(query) : {};
const sanitizedQueryObject = sanitizeQuery(queryObject, customAccountability);
let result: Item | Item[] | null;
if (!key) {
result = await itemsService.readByQuery(queryObject);
result = await itemsService.readByQuery(sanitizedQueryObject);
} else {
const keys = toArray(key);
if (keys.length === 1) {
result = await itemsService.readOne(keys[0], queryObject);
result = await itemsService.readOne(keys[0], sanitizedQueryObject);
} else {
result = await itemsService.readMany(keys, queryObject);
result = await itemsService.readMany(keys, sanitizedQueryObject);
}
}

6
api/src/operations/item-update/index.ts
View File

@@ -2,8 +2,9 @@ import { Accountability, PrimaryKey } from '@directus/shared/types';
import { defineOperationApi, toArray } from '@directus/shared/utils';
import { ItemsService } from '../../services';
import { Item } from '../../types';
import { optionToObject } from '../../utils/operation-options';
import { getAccountabilityForRole } from '../../utils/get-accountability-for-role';
import { optionToObject } from '../../utils/operation-options';
import { sanitizeQuery } from '../../utils/sanitize-query';
type Options = {
collection: string;
@@ -40,6 +41,7 @@ export default defineOperationApi<Options>({
const payloadObject: Partial<Item> | Partial<Item>[] | null = optionToObject(payload) ?? null;
const queryObject = query ? optionToObject(query) : {};
const sanitizedQueryObject = sanitizeQuery(queryObject, customAccountability);
if (!payloadObject) {
return null;
@@ -48,7 +50,7 @@ export default defineOperationApi<Options>({
let result: PrimaryKey | PrimaryKey[] | null;
if (!key) {
result = await itemsService.updateByQuery(queryObject, payloadObject);
result = await itemsService.updateByQuery(sanitizedQueryObject, payloadObject);
} else {
const keys = toArray(key);