@allbluecn/shared 0.4.7 → 0.4.9
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -7,7 +7,7 @@ async function resolveDisplay(targetModule, targetEntityId, entityType) {
|
|
|
7
7
|
const entity = entityType ? mod.entities.find((e) => e.type === entityType) : mod.entities[0];
|
|
8
8
|
if (!entity) return { title: `[${targetModule}:${targetEntityId}]` };
|
|
9
9
|
try {
|
|
10
|
-
const fields = [...entity.displayFields, "id"].join(", ");
|
|
10
|
+
const fields = [...entity.displayFields, "id"].filter((f) => /^[a-zA-Z_][a-zA-Z0-9_]*$/.test(f)).join(", ");
|
|
11
11
|
const rows = await getPrismaSeam().$queryRawUnsafe(`SELECT ${fields} FROM \`${entity.table}\` WHERE id = ?`, targetEntityId);
|
|
12
12
|
if (!rows.length) return {
|
|
13
13
|
title: `Deleted ${entity.type}`,
|
|
@@ -42,9 +42,11 @@ async function searchReferences(query, types) {
|
|
|
42
42
|
const mod = moduleRegistry.getModule(config.module);
|
|
43
43
|
if (!mod) continue;
|
|
44
44
|
const searchField = config.fields[0];
|
|
45
|
+
const safeSearchField = /^[a-zA-Z_][a-zA-Z0-9_]*$/.test(searchField) ? searchField : "id";
|
|
46
|
+
const safeFields = config.fields.filter((f) => /^[a-zA-Z_][a-zA-Z0-9_]*$/.test(f));
|
|
45
47
|
const seam = getPrismaSeam();
|
|
46
48
|
try {
|
|
47
|
-
const rows = await seam.$queryRawUnsafe(`SELECT id, ${
|
|
49
|
+
const rows = await seam.$queryRawUnsafe(`SELECT id, ${safeFields.join(", ")} FROM \`${mod.entities[0].table}\` WHERE \`${safeSearchField}\` LIKE ? LIMIT 20`, `%${query}%`);
|
|
48
50
|
for (const row of rows) {
|
|
49
51
|
const display = mod.referenceDisplay(config.type, row);
|
|
50
52
|
results.push({
|