diff --git a/ckanext/datastore/db.py b/ckanext/datastore/db.py index fb597d7053e..77054d73c88 100644 --- a/ckanext/datastore/db.py +++ b/ckanext/datastore/db.py @@ -1108,7 +1108,7 @@ def search_sql(context, data_dict): context['connection'].execute( u'SET LOCAL statement_timeout TO {0}'.format(timeout)) results = context['connection'].execute( - data_dict['sql'] + data_dict['sql'].replace('%', '%%') ) return format_results(context, results, data_dict) diff --git a/ckanext/datastore/tests/test_search.py b/ckanext/datastore/tests/test_search.py index 10b4e66c7de..9bd46db6e10 100644 --- a/ckanext/datastore/tests/test_search.py +++ b/ckanext/datastore/tests/test_search.py @@ -502,6 +502,18 @@ def test_select_basic(self): assert result['records'] == res_dict_alias['result']['records'] + def test_select_where_like_with_percent(self): + query = 'SELECT * FROM public."{0}" WHERE "author" LIKE \'tol%\''.format(self.data['resource_id']) + data = {'sql': query} + postparams = json.dumps(data) + auth = {'Authorization': str(self.sysadmin_user.apikey)} + res = self.app.post('/api/action/datastore_search_sql', params=postparams, + extra_environ=auth) + res_dict = json.loads(res.body) + assert res_dict['success'] is True + result = res_dict['result'] + assert result['records'] == self.expected_records + def test_self_join(self): query = ''' select a._id as first, b._id as second