diff --git a/pybossa/sched.py b/pybossa/sched.py index d6050d49d..459d623c9 100644 --- a/pybossa/sched.py +++ b/pybossa/sched.py @@ -419,7 +419,8 @@ def reserve_task_sql_filters(project_id, reserve_task_keys, exclude): filter_list = [] for i in range(0, len(category_fv), 2): key, value = category_fv[i], category_fv[i + 1] - filter_list.append("task.info->>'{}' = '{}'".format(key, value)) + escaped_value = value.replace("'", "''") + filter_list.append("task.info->>'{}' = '{}'".format(key, escaped_value)) filter_dict[category] = "({})".format(" AND ".join(filter_list)) if filter_dict: diff --git a/test/test_reserve_task_category.py b/test/test_reserve_task_category.py index 8bb2e4a1d..b47efd6e0 100644 --- a/test/test_reserve_task_category.py +++ b/test/test_reserve_task_category.py @@ -79,6 +79,15 @@ def test_task_category_to_sql_filter(self): "reserve_task:project:202:category:x:1:y:2:z:3:user:1008:task:454" ], "filters, category must be as per keys passed and include negate, NOT IN clause" + # task category key exists, returns sql filter and its associated category_keys + project_id, exclude = "202", False + task_info = dict(name1="john's value", name2="john's baker's value") + expected_sql_filter = " AND ((task.info->>'name1' = 'john''s value' AND task.info->>'name2' = 'john''s baker''s value')) " + reserve_task_keys = ["reserve_task:project:{}:category:name1:john's value:name2:john's baker's value:user:1008:task:454".format(project_id)] + filters, category_keys = reserve_task_sql_filters(project_id, reserve_task_keys, exclude) + assert filters == expected_sql_filter and \ + category_keys == reserve_task_keys, "filters, category must be non empty" + @with_context @patch('pybossa.redis_lock.LockManager.get_task_category_lock')