Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix invalid input for advanced search sort_by #1255

Merged
merged 7 commits into from Nov 10, 2021

Conversation

glensc
Copy link
Member

@glensc glensc commented Nov 9, 2021

Followup to #1252:

The fix didn't account for custom fields and resulted sql error in case of invalid input, which resulted a 500 page.

The new fix, field is validated against the list from the adv_search template only when not using custom fields:

  • <label>{t}Sort By{/t}<br />
    <select name="sort_by">
    <option value="last_action_date" {if $options.cst_sort_by|default:'' == "last_action_date"}selected{/if}>{t}Last Action Date{/t}</option>
    <option value="pri_rank" {if $options.cst_sort_by|default:'' == "pri_rank"}selected{/if}>{t}Priority{/t}</option>
    <option value="iss_id" {if $options.cst_sort_by|default:'' == "iss_id"}selected{/if}>{t}Issue ID{/t}</option>
    <option value="sta_rank" {if $options.cst_sort_by|default:'' == "sta_rank"}selected{/if}>{t}Status{/t}</option>
    <option value="iss_summary" {if $options.cst_sort_by|default:'' == "iss_summary"}selected{/if}>{t}Summary{/t}</option>
    </select>

Also, the $sort_by is now escaped with quoteIdentifier (method for columns) rather escape (method for values)

@glensc glensc added this to the 3.10.8 milestone Nov 9, 2021
@glensc glensc self-assigned this Nov 9, 2021
@glensc glensc merged commit 15f749f into eventum:master Nov 10, 2021
@glensc glensc deleted the 1252-followup branch November 10, 2021 00:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging this pull request may close these issues.

None yet

1 participant